ipv6: fix incorrect route 'expires' value passed to userspace (8253947e) · Commits · 戴 / test

When userspace use RTM_GETROUTE to dump route table, with an already expired route entry, we always got an 'expires' value(2147157) calculated base on INT_MAX. The reason of this problem is in the following satement: rt->dst.expires - jiffies < INT_MAX gcc promoted the type of both sides of '<' to unsigned long, thus a small negative value would be considered greater than INT_MAX. With the help of Eric Dumazet, do the out of bound checks in rtnl_put_cacheinfo(), _after_ conversion to clock_t. Signed-off-by:

Li Wei <lw@cn.fujitsu.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/core/rtnetlink.c

+6 −2

Original line number	Diff line number	Diff line
		@@ -625,9 +625,13 @@ int rtnl_put_cacheinfo(struct sk_buff skb, struct dst_entry dst, u32 id,
		.rta_id = id,
		};

		if (expires)
		ci.rta_expires = jiffies_to_clock_t(expires);
		if (expires) {
		unsigned long clock;

		clock = jiffies_to_clock_t(abs(expires));
		clock = min_t(unsigned long, clock, INT_MAX);
		ci.rta_expires = (expires > 0) ? clock : -clock;
		}
		return nla_put(skb, RTA_CACHEINFO, sizeof(ci), &ci);
		}
		EXPORT_SYMBOL_GPL(rtnl_put_cacheinfo);

net/ipv6/route.c

+2 −6

Original line number	Diff line number	Diff line
		@@ -2480,12 +2480,8 @@ static int rt6_fill_node(struct net *net,
		goto nla_put_failure;
		if (nla_put_u32(skb, RTA_PRIORITY, rt->rt6i_metric))
		goto nla_put_failure;
		if (!(rt->rt6i_flags & RTF_EXPIRES))
		expires = 0;
		else if (rt->dst.expires - jiffies < INT_MAX)
		expires = rt->dst.expires - jiffies;
		else
		expires = INT_MAX;

		expires = (rt->rt6i_flags & RTF_EXPIRES) ? rt->dst.expires - jiffies : 0;

		if (rtnl_put_cacheinfo(skb, &rt->dst, 0, expires, rt->dst.error) < 0)
		goto nla_put_failure;

Admin message