Message ID | 1502912332-41154-1-git-send-email-roopa@cumulusnetworks.com |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
From: Roopa Prabhu <roopa@cumulusnetworks.com> Date: Wed, 16 Aug 2017 12:38:52 -0700 > From: Roopa Prabhu <roopa@cumulusnetworks.com> > > Syzkaller hit 'general protection fault in fib_dump_info' bug on > commit 4.13-rc5.. > > Guilty file: net/ipv4/fib_semantics.c ... > This patch adds a res->fi NULL check. > > example run: > $ip route get 0.0.0.0 iif virt1-0 > broadcast 0.0.0.0 dev lo > cache <local,brd> iif virt1-0 > > $ip route get 0.0.0.0 iif virt1-0 fibmatch > RTNETLINK answers: No route to host > > Reported-by: idaifish <idaifish@gmail.com> > Reported-by: Dmitry Vyukov <dvyukov@google.com> > Fixes: b61798130f1b ("net: ipv4: RTM_GETROUTE: return matched fib result when requested") > Signed-off-by: Roopa Prabhu <roopa@cumulusnetworks.com> Applied, thank you.
diff --git a/net/ipv4/route.c b/net/ipv4/route.c index 7effa62..468d6a3 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -2763,14 +2763,21 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, if (rtm->rtm_flags & RTM_F_LOOKUP_TABLE) table_id = rt->rt_table_id; - if (rtm->rtm_flags & RTM_F_FIB_MATCH) + if (rtm->rtm_flags & RTM_F_FIB_MATCH) { + if (!res.fi) { + err = fib_props[res.type].error; + if (!err) + err = -EHOSTUNREACH; + goto errout_free; + } err = fib_dump_info(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq, RTM_NEWROUTE, table_id, rt->rt_type, res.prefix, res.prefixlen, fl4.flowi4_tos, res.fi, 0); - else + } else { err = rt_fill_info(net, dst, src, table_id, &fl4, skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq); + } if (err < 0) goto errout_free;