lkml.org 
[lkml]   [2008]   [Aug]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: OOPS, ip -f inet6 route get fec0::1, linux-2.6.26, ip6_route_output, rt6_fill_node+0x175
    Alexey Dobriyan wrote:
    > On Thu, Aug 07, 2008 at 07:00:56PM +0200, John Gumb wrote:
    >> Scenario: no ipv6 default route set.
    >
    >> # ip -f inet6 route get fec0::1
    >>
    >> BUG: unable to handle kernel NULL pointer dereference at 00000000
    >> IP: [<c0369b85>] rt6_fill_node+0x175/0x3b0
    >> EIP is at rt6_fill_node+0x175/0x3b0
    >
    > 0xffffffff80424dd3 is in rt6_fill_node (net/ipv6/route.c:2191).
    > 2186 } else
    > 2187 #endif
    > 2188 NLA_PUT_U32(skb, RTA_IIF, iif);
    > 2189 } else if (dst) {
    > 2190 struct in6_addr saddr_buf;
    > 2191 ====> if (ipv6_dev_get_saddr(ip6_dst_idev(&rt->u.dst)->dev,
    > ^^^^^^^^^^^^^^^^^^^^^^^^
    > NULL
    >
    > 2192 dst, 0, &saddr_buf) == 0)
    > 2193 NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
    > 2194 }

    The commit that changed this can't be reverted easily, but the patch
    below works for me.

    Fix NULL de-reference in rt6_fill_node() when there's no IPv6 input
    device present in the dst entry.

    Signed-off-by: Brian Haley <brian.haley@hp.com>


    diff --git a/net/ipv6/route.c b/net/ipv6/route.c
    index 5a3e87e..303a245 100644
    --- a/net/ipv6/route.c
    +++ b/net/ipv6/route.c
    @@ -2188,7 +2188,8 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
    NLA_PUT_U32(skb, RTA_IIF, iif);
    } else if (dst) {
    struct in6_addr saddr_buf;
    - if (ipv6_dev_get_saddr(ip6_dst_idev(&rt->u.dst)->dev,
    + struct inet6_dev *idev = ip6_dst_idev(&rt->u.dst);
    + if (ipv6_dev_get_saddr(idev ? idev->dev : NULL,
    dst, 0, &saddr_buf) == 0)
    NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
    }
    \
     
     \ /
      Last update: 2008-08-08 07:01    [W:0.039 / U:60.472 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site