* [PATCH v2 net] ipv6: fix crash on ICMPv6 redirects with prohibited/blackholed source
@ 2015-11-02 0:24 Matthias Schiffer
2015-11-02 21:30 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Matthias Schiffer @ 2015-11-02 0:24 UTC (permalink / raw
To: davem; +Cc: netdev
There are other error values besides ip6_null_entry that can be returned by
ip6_route_redirect(): fib6_rule_action() can also result in
ip6_blk_hole_entry and ip6_prohibit_entry if such ip rules are installed.
Only checking for ip6_null_entry in rt6_do_redirect() causes ip6_ins_rt()
to be called with rt->rt6i_table == NULL in these cases, making the kernel
crash.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
---
v2: remove now unused variable net
net/ipv6/route.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 946880a..cc88a73 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2099,7 +2099,6 @@ static int ip6_route_del(struct fib6_config *cfg)
static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buff *skb)
{
- struct net *net = dev_net(skb->dev);
struct netevent_redirect netevent;
struct rt6_info *rt, *nrt = NULL;
struct ndisc_options ndopts;
@@ -2160,7 +2159,7 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu
}
rt = (struct rt6_info *) dst;
- if (rt == net->ipv6.ip6_null_entry) {
+ if (rt->rt6i_flags & RTF_REJECT) {
net_dbg_ratelimited("rt6_redirect: source isn't a valid nexthop for redirect target\n");
return;
}
--
2.6.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v2 net] ipv6: fix crash on ICMPv6 redirects with prohibited/blackholed source
2015-11-02 0:24 [PATCH v2 net] ipv6: fix crash on ICMPv6 redirects with prohibited/blackholed source Matthias Schiffer
@ 2015-11-02 21:30 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2015-11-02 21:30 UTC (permalink / raw
To: mschiffer; +Cc: netdev
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Mon, 2 Nov 2015 01:24:38 +0100
> There are other error values besides ip6_null_entry that can be returned by
> ip6_route_redirect(): fib6_rule_action() can also result in
> ip6_blk_hole_entry and ip6_prohibit_entry if such ip rules are installed.
>
> Only checking for ip6_null_entry in rt6_do_redirect() causes ip6_ins_rt()
> to be called with rt->rt6i_table == NULL in these cases, making the kernel
> crash.
>
> Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Applied.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-11-02 21:30 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-11-02 0:24 [PATCH v2 net] ipv6: fix crash on ICMPv6 redirects with prohibited/blackholed source Matthias Schiffer
2015-11-02 21:30 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.