[3.8.y.z extended stable] Patch "ip6_tunnel: fix potential NULL pointer dereference" has been added to staging queue

[Kamal Mostafa]

This is a note to let you know that I have just added a patch titled

    ip6_tunnel: fix potential NULL pointer dereference

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

This patch is scheduled to be released in version 3.8.13.24.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

>From cd485c2a3a3bd545ad4114f6c64245719502072e Mon Sep 17 00:00:00 2001
From: Susant Sahani <susant at redhat.com>
Date: Sat, 10 May 2014 00:11:32 +0530
Subject: ip6_tunnel: fix potential NULL pointer dereference

[ Upstream commit c8965932a2e3b70197ec02c6741c29460279e2a8 ]

The function ip6_tnl_validate assumes that the rtnl
attribute IFLA_IPTUN_PROTO always be filled . If this
attribute is not filled by  the userspace application
kernel get crashed with NULL pointer dereference. This
patch fixes the potential kernel crash when
IFLA_IPTUN_PROTO is missing .

Signed-off-by: Susant Sahani <susant at redhat.com>
Acked-by: Thomas Graf <tgraf at suug.ch>
Signed-off-by: David S. Miller <davem at davemloft.net>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 net/ipv6/ip6_tunnel.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 78af3c7..2ce58fe 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1545,7 +1545,7 @@ static int ip6_tnl_validate(struct nlattr *tb[], struct nlattr *data[])
 {
 	u8 proto;

-	if (!data)
+	if (!data || !data[IFLA_IPTUN_PROTO])
 		return 0;

 	proto = nla_get_u8(data[IFLA_IPTUN_PROTO]);
--
1.9.1