Messages in this thread | | | Date | Wed, 8 Dec 2021 11:34:14 -0500 | From | Stephen Suryaputra <> | Subject | Re: [PATCH] ipv6: fix NULL pointer dereference in ip6_output() |
| |
On Wed, Dec 08, 2021 at 08:46:37AM -0700, David Ahern wrote: > On 12/8/21 3:51 AM, Florian Westphal wrote: > > David Ahern <dsahern@gmail.com> wrote: > >> On 12/7/21 5:21 PM, Andrea Mayer wrote: > >>> + IP6CB(skb)->iif = skb->skb_iif; > >>> [...] > >>> > >>> What do you think? > >>> > >> > >> I like that approach over the need for a fall back in core ipv6 code. > > > > What if the device is removed after ->iif assignment and before dev lookup? > > > > good point. SR6 should make sure the iif is not cleared, and the > fallback to the skb->dev is still needed in case of delete.
Thanks for the explanation. I was thinking that ->iif can safely be assumed to be valid. Florian's point that device can be removed is a good one. My bad for not putting the check and thanks for fixing.
| |