[PATCH] Kernel oops in ip6t_LOG.c:ip6_nexthdr

[Olaf Kirch <okir@xxxxxxx>]

Hi,

We just ran into a kernel oops after enabling ipv6 packet filtering.
The machine would choke on the IGMPv6 packets sent out when the
interface is taken up. The reason is this code:

                /*stupid rfc2402 */
                case IPPROTO_DSTOPTS:
                case IPPROTO_ROUTING:
                case IPPROTO_HOPOPTS:
                        nexthdr = **hdrptr;
                        hdrlen = *hdrptr[1] * 8 + 8;
                                 ^^^^^^^^^^ it dies here
                        *hdrptr = *hdrptr + hdrlen;
                        break;

hdrptr is a u_int8_t **. What you really want to do here is
look at (*hdrptr)[1], but what the expression does is look at
*(hdrptr[1]). Unfortunately, hdrptr[1] is usually random garbage.

The attached patch fixes this.

Olaf
-- 
Olaf Kirch     |  The Hardware Gods hate me.
okir@xxxxxxx   |
---------------+

netfilter6-logging
Description: Text document