| Message ID | 1460089718-25788-1-git-send-email-roopa@cumulusnetworks.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
From: Roopa Prabhu <roopa@cumulusnetworks.com> Date: Thu, 7 Apr 2016 21:28:38 -0700 > From: Roopa Prabhu <roopa@cumulusnetworks.com> > > find_outdev calls inet{,6}_fib_lookup_dev() or dev_get_by_index() to > find the output device. In case of an error, inet{,6}_fib_lookup_dev() > returns error pointer and dev_get_by_index() returns NULL. But the function > only checks for NULL and thus can end up calling dev_put on an ERR_PTR. > This patch adds an additional check for err ptr after the NULL check. > > Before: Trying to add an mpls route with no oif from user, no available > path to 10.1.1.8 and no default route: > $ip -f mpls route add 100 as 200 via inet 10.1.1.8 > [ 822.337195] BUG: unable to handle kernel NULL pointer dereference at > 00000000000003a3 ... > After patch: > $ip -f mpls route add 100 as 200 via inet 10.1.1.8 > RTNETLINK answers: Network is unreachable > > Signed-off-by: Roopa Prabhu <roopa@cumulusnetworks.com> > Reported-by: David Miller <davem@davemloft.net> Applied, thanks.
diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c index b18c5ed..0b80a71 100644 --- a/net/mpls/af_mpls.c +++ b/net/mpls/af_mpls.c @@ -543,6 +543,9 @@ static struct net_device *find_outdev(struct net *net, if (!dev) return ERR_PTR(-ENODEV); + if (IS_ERR(dev)) + return dev; + /* The caller is holding rtnl anyways, so release the dev reference */ dev_put(dev);