A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-28 18:51:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

inet: fix NULL pointer Oops in fib(6)_rule_suppress

Browse source 
This changes ensures that the routing entry investigated by the suppress
function actually does point to a device struct before following that pointer,
fixing a possible kernel oops situation when verifying the interface group
associated with a routing table entry.

According to Daniel Golle, this Oops can be triggered by a user process trying
to establish an outgoing IPv6 connection while having no real IPv6 connectivity
set up (only autoassigned link-local addresses).

Fixes: 6ef94cfafb ("fib_rules: add route suppression based on ifgroup")

Reported-by: Daniel Golle <[email protected]>
Tested-by: Daniel Golle <[email protected]>
Signed-off-by: Stefan Tomanek <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
This commit is contained in:
Stefan Tomanek 2013-12-10 23:21:25 +01:00 • committed by David S. Miller
commit 673498b8ed
2 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
net/ipv4/fib_rules.c
View file

@ -104,7 +104,10 @@ errout:
static bool fib4_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg)
{
struct fib_result *result = (struct fib_result *) arg->result;
struct net_device *dev = result->fi->fib_dev;
struct net_device *dev = NULL;
if (result->fi)
dev = result->fi->fib_dev;
/* do not accept result if the route does
* not meet the required prefix length

6
net/ipv6/fib6_rules.c
View file

@ -122,7 +122,11 @@ out:
static bool fib6_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg)
{
struct rt6_info *rt = (struct rt6_info *) arg->result;
struct net_device *dev = rt->rt6i_idev->dev;
struct net_device *dev = NULL;
if (rt->rt6i_idev)
dev = rt->rt6i_idev->dev;
/* do not accept result if the route does
* not meet the required prefix length
*/