Commit 673498b8 authored Dec 10, 2013 by Stefan Tomanek Committed by David S. Miller Dec 10, 2013

inet: fix NULL pointer Oops in fib(6)_rule_suppress

This changes ensures that the routing entry investigated by the suppress
function actually does point to a device struct before following that pointer,
fixing a possible kernel oops situation when verifying the interface group
associated with a routing table entry.

According to Daniel Golle, this Oops can be triggered by a user process trying
to establish an outgoing IPv6 connection while having no real IPv6 connectivity
set up (only autoassigned link-local addresses).

Fixes: 6ef94cfa ("fib_rules: add route suppression based on ifgroup")

Reported-by: Daniel Golle <daniel.golle@gmail.com>
Tested-by: Daniel Golle <daniel.golle@gmail.com>
Signed-off-by: Stefan Tomanek <stefan.tomanek@wertarbyte.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent d323e92c

net/ipv4/fib_rules.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -104,7 +104,10 @@ errout:
		static bool fib4_rule_suppress(struct fib_rule rule, struct fib_lookup_arg arg)
		{
		struct fib_result result = (struct fib_result ) arg->result;
		struct net_device *dev = result->fi->fib_dev;
		struct net_device *dev = NULL;

		if (result->fi)
		dev = result->fi->fib_dev;

		/* do not accept result if the route does
		* not meet the required prefix length

net/ipv6/fib6_rules.c

+5 −1

Original line number	Diff line number	Diff line
		@@ -122,7 +122,11 @@ out:
		static bool fib6_rule_suppress(struct fib_rule rule, struct fib_lookup_arg arg)
		{
		struct rt6_info rt = (struct rt6_info ) arg->result;
		struct net_device *dev = rt->rt6i_idev->dev;
		struct net_device *dev = NULL;

		if (rt->rt6i_idev)
		dev = rt->rt6i_idev->dev;

		/* do not accept result if the route does
		* not meet the required prefix length
		*/

Admin message