[REGRESSION v3.14-rc2] NULL dereference in icmp6_send()

I was sitting in the Admiral's Club of Boston Logan airport, having
connected to the free airport wifi, although I had not yet logged into
the captive portal, when I received the following BUG.   I've also seen
this once before when connected to my home network (running the CeroWRT
stable snapshot, versoin 3.7.5-2), although I wasn't able to get a
screen shot that time:

https://plus.google.com/photos/+TheodoreTso/albums/5981437894092747105/5981437896646076466

The transcribed stack dump is:

icmp6_send
ip6_expire_frag_queue
ip6_frag_expire
call_timer_fn
run_timer_softirq
irq_exit
...

I was running v3.13 and v3.13-rcX previously without seeing this, so I
suspect this is a regression.

Cheers,

                                                - Ted

Hi!

On Mon, Feb 17, 2014 at 01:46:13PM -0500, Theodore Ts'o wrote:

I was sitting in the Admiral's Club of Boston Logan airport, having
connected to the free airport wifi, although I had not yet logged into
the captive portal, when I received the following BUG.   I've also seen
this once before when connected to my home network (running the CeroWRT
stable snapshot, versoin 3.7.5-2), although I wasn't able to get a
screen shot that time:

https://plus.google.com/photos/+TheodoreTso/albums/5981437894092747105/5981437896646076466

The transcribed stack dump is:

icmp6_send
ip6_expire_frag_queue
ip6_frag_expire
call_timer_fn
run_timer_softirq
irq_exit
...

I was running v3.13 and v3.13-rcX previously without seeing this, so I
suspect this is a regression.

At that point the skb does not have a dst attached, so we panic in
icmp6_send.

This is fixed here:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=d94c1f92bbf2c42c5febd68bbea51fffeac90834

Greetings,

  Hannes

From: Hannes Frederic Sowa <redacted>
Date: Mon, 17 Feb 2014 19:50:53 +0100

At that point the skb does not have a dst attached, so we panic in
icmp6_send.

This is fixed here:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=d94c1f92bbf2c42c5febd68bbea51fffeac90834

Yep I'll get this to Linus soon.

On Mon, Feb 17, 2014 at 07:50:53PM +0100, Hannes Frederic Sowa wrote:

At that point the skb does not have a dst attached, so we panic in
icmp6_send.

This is fixed here:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=d94c1f92bbf2c42c5febd68bbea51fffeac90834

Thanks!!

BTW, apologies for the inadvertent share of the photo to my G+ stream.
I had taken the photo using my cell phone, and I was trying to make
sure the URL was publically viewable before I filed the bug report.

					- Ted