Commit dc848292 authored Jun 24, 2013 by Hannes Frederic Sowa Committed by David S. Miller Jun 25, 2013

ipv6: check return value of ipv6_get_lladdr



We should check the return value of ipv6_get_lladdr in inet6_set_iftoken.

A possible situation, which could leave ll_addr unassigned is, when
the user removed her link-local address but a global scoped address was
already set. In this case the interface would still be IF_READY and not
dead. In that case the RS source address is some value from the stack.

v2: Daniel Borkmann noted a small indent inconstancy; no semantic
changes.

Cc: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Reviewed-by: Flavio Leitner <fbl@redhat.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 4c7ab054

net/ipv6/addrconf.c

+4 −5

Original line number	Diff line number	Diff line
		@@ -4306,6 +4306,7 @@ static int inet6_set_iftoken(struct inet6_dev idev, struct in6_addr token)
		struct inet6_ifaddr *ifp;
		struct net_device *dev = idev->dev;
		bool update_rs = false;
		struct in6_addr ll_addr;

		if (token == NULL)
		return -EINVAL;
		@@ -4325,11 +4326,9 @@ static int inet6_set_iftoken(struct inet6_dev idev, struct in6_addr token)

		write_unlock_bh(&idev->lock);

		if (!idev->dead && (idev->if_flags & IF_READY)) {
		struct in6_addr ll_addr;

		ipv6_get_lladdr(dev, &ll_addr, IFA_F_TENTATIVE \|
		IFA_F_OPTIMISTIC);
		if (!idev->dead && (idev->if_flags & IF_READY) &&
		!ipv6_get_lladdr(dev, &ll_addr, IFA_F_TENTATIVE \|
		IFA_F_OPTIMISTIC)) {

		/* If we're not ready, then normal ifup will take care
		* of this. Otherwise, we need to request our rs here.

Admin message