Commit 673498b8 authored by Stefan Tomanek's avatar Stefan Tomanek Committed by David S. Miller

inet: fix NULL pointer Oops in fib(6)_rule_suppress

This changes ensures that the routing entry investigated by the suppress
function actually does point to a device struct before following that pointer,
fixing a possible kernel oops situation when verifying the interface group
associated with a routing table entry.

According to Daniel Golle, this Oops can be triggered by a user process trying
to establish an outgoing IPv6 connection while having no real IPv6 connectivity
set up (only autoassigned link-local addresses).

Fixes: 6ef94cfa ("fib_rules: add route suppression based on ifgroup")
Reported-by: default avatarDaniel Golle <daniel.golle@gmail.com>
Tested-by: default avatarDaniel Golle <daniel.golle@gmail.com>
Signed-off-by: default avatarStefan Tomanek <stefan.tomanek@wertarbyte.de>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent d323e92c
......@@ -104,7 +104,10 @@ static int fib4_rule_action(struct fib_rule *rule, struct flowi *flp,
static bool fib4_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg)
{
struct fib_result *result = (struct fib_result *) arg->result;
struct net_device *dev = result->fi->fib_dev;
struct net_device *dev = NULL;
if (result->fi)
dev = result->fi->fib_dev;
/* do not accept result if the route does
* not meet the required prefix length
......
......@@ -122,7 +122,11 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
static bool fib6_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg)
{
struct rt6_info *rt = (struct rt6_info *) arg->result;
struct net_device *dev = rt->rt6i_idev->dev;
struct net_device *dev = NULL;
if (rt->rt6i_idev)
dev = rt->rt6i_idev->dev;
/* do not accept result if the route does
* not meet the required prefix length
*/
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment