Re: [PATCH] Prevent crash on ip_conntrack removal

["David S. Miller" <davem@xxxxxxxxxx>]

On Sat, 21 Aug 2004 17:10:20 +0200
Patrick McHardy <kaber@xxxxxxxxx> wrote:

> David S. Miller wrote:
> 
> >I have a better idea.
> >
> >Instead of setting skb->dst to NULL, it should set it to some
> >NULL destination entry which just frees up the packets.  Then
> >no special case handling.  skb->dst==NULL packets should never
> >get into the fragment queue to begin with.
> >
> The problem is that conntrack unload can cause packets without a
> dst_entry to appear in ip_local_deliver, which is already after
> the call to dst_input.

How can it call ip_local_deliver() without a valid skb->dst?
That function is only invoked via skb->dst->input(skb) which
by implication means that skb->dst is non-NULL.

Actually there is a call via ip_mr_input() but that code also
has a precondition that skb->dst is non-NULL too.  I say this
due to the unchecked skb->dst accesses it makes early on.

Please explain.  I don't question that it happens, just show
me how :-)