diff mbox

[1/3] netfilter: Fix potential use after free in ip6_route_me_harder()

Message ID 1399389441-20095-1-git-send-email-popovich_sergei@mail.ru
State Changes Requested, archived
Delegated to: David Miller
Headers show

Commit Message

Sergey Popovich May 6, 2014, 3:17 p.m. UTC
Dst is released one line before we access it again with dst->error.

Fixes: 58e35d147128 netfilter: ipv6: propagate routing errors from
ip6_route_me_harder()

Signed-off-by: Sergey Popovich <popovich_sergei@mail.ru>
---
 net/ipv6/netfilter.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Comments

David Miller May 7, 2014, 9:12 p.m. UTC | #1
From: Sergey Popovich <popovich_sergei@mail.ru>
Date: Tue,  6 May 2014 18:17:19 +0300

> Dst is released one line before we access it again with dst->error.
> 
> Fixes: 58e35d147128 netfilter: ipv6: propagate routing errors from
> ip6_route_me_harder()
> 
> Signed-off-by: Sergey Popovich <popovich_sergei@mail.ru>

Sergey, please do not submit patch series crossing multiple maintainers
(here Netfilter vs. generic networking) without first coordinating with
those maintainers as to who will take your entire series in.

Another option is to submit things in the usual manner, submit the
netfilter change to the netfilter maintainer, and then seperately
the other two patches to me.

I'm dropping these patches.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 95f3f1d..d38e6a8 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -30,13 +30,15 @@  int ip6_route_me_harder(struct sk_buff *skb)
 		.daddr = iph->daddr,
 		.saddr = iph->saddr,
 	};
+	int err;
 
 	dst = ip6_route_output(net, skb->sk, &fl6);
-	if (dst->error) {
+	err = dst->error;
+	if (err) {
 		IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
 		LIMIT_NETDEBUG(KERN_DEBUG "ip6_route_me_harder: No more route.\n");
 		dst_release(dst);
-		return dst->error;
+		return err;
 	}
 
 	/* Drop old route. */