| Message ID | bf7886537e41d9e9ac1a0d901283daf22b0b5df1.1446419326.git.mschiffer@universe-factory.net |
|---|---|
| State | Superseded, archived |
| Delegated to: | David Miller |
| Headers | show |
Hi Matthias,
[auto build test WARNING on net/master -- if it's inappropriate base, please suggest rules for selecting the more suitable base]
url: https://github.com/0day-ci/linux/commits/Matthias-Schiffer/ipv6-fix-crash-on-ICMPv6-redirects-with-prohibited-blackholed-source/20151102-072158
config: x86_64-allyesconfig (attached as .config)
reproduce:
# save the attached .config to linux build tree
make ARCH=x86_64
All warnings (new ones prefixed by >>):
net/ipv6/route.c: In function 'rt6_do_redirect':
>> net/ipv6/route.c:2102:14: warning: unused variable 'net' [-Wunused-variable]
struct net *net = dev_net(skb->dev);
^
vim +/net +2102 net/ipv6/route.c
^1da177e Linus Torvalds 2005-04-16 2086 continue;
86872cb5 Thomas Graf 2006-08-22 2087 if (cfg->fc_metric && cfg->fc_metric != rt->rt6i_metric)
^1da177e Linus Torvalds 2005-04-16 2088 continue;
d8d1f30b Changli Gao 2010-06-10 2089 dst_hold(&rt->dst);
c71099ac Thomas Graf 2006-08-04 2090 read_unlock_bh(&table->tb6_lock);
^1da177e Linus Torvalds 2005-04-16 2091
86872cb5 Thomas Graf 2006-08-22 2092 return __ip6_del_rt(rt, &cfg->fc_nlinfo);
^1da177e Linus Torvalds 2005-04-16 2093 }
^1da177e Linus Torvalds 2005-04-16 2094 }
c71099ac Thomas Graf 2006-08-04 2095 read_unlock_bh(&table->tb6_lock);
^1da177e Linus Torvalds 2005-04-16 2096
^1da177e Linus Torvalds 2005-04-16 2097 return err;
^1da177e Linus Torvalds 2005-04-16 2098 }
^1da177e Linus Torvalds 2005-04-16 2099
6700c270 David S. Miller 2012-07-17 2100 static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buff *skb)
a6279458 YOSHIFUJI Hideaki 2006-08-23 2101 {
e8599ff4 David S. Miller 2012-07-11 @2102 struct net *net = dev_net(skb->dev);
a6279458 YOSHIFUJI Hideaki 2006-08-23 2103 struct netevent_redirect netevent;
e8599ff4 David S. Miller 2012-07-11 2104 struct rt6_info *rt, *nrt = NULL;
e8599ff4 David S. Miller 2012-07-11 2105 struct ndisc_options ndopts;
e8599ff4 David S. Miller 2012-07-11 2106 struct inet6_dev *in6_dev;
e8599ff4 David S. Miller 2012-07-11 2107 struct neighbour *neigh;
71bcdba0 YOSHIFUJI Hideaki / 吉藤英明 2013-01-05 2108 struct rd_msg *msg;
6e157b6a David S. Miller 2012-07-12 2109 int optlen, on_link;
6e157b6a David S. Miller 2012-07-12 2110 u8 *lladdr;
:::::: The code at line 2102 was first introduced by commit
:::::: e8599ff4b1d6b0d61e1074ae4ba9fca8dd0c41d0 ipv6: Move bulk of redirect handling into rt6_redirect().
:::::: TO: David S. Miller <davem@davemloft.net>
:::::: CC: David S. Miller <davem@davemloft.net>
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation
diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 946880a..c196ed7 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -2160,7 +2160,7 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu } rt = (struct rt6_info *) dst; - if (rt == net->ipv6.ip6_null_entry) { + if (rt->rt6i_flags & RTF_REJECT) { net_dbg_ratelimited("rt6_redirect: source isn't a valid nexthop for redirect target\n"); return; }
There are other error values besides ip6_null_entry that can be returned by ip6_route_redirect(): fib6_rule_action() can also result in ip6_blk_hole_entry and ip6_prohibit_entry if such ip rules are installed. Only checking for ip6_null_entry in rt6_do_redirect() causes ip6_ins_rt() to be called with rt->rt6i_table == NULL in these cases, making the kernel crash. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net> --- This bug exists pretty much forever, please queue up for all -stable kernels. net/ipv6/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)