Message ID | 20190710134011.221210-2-edumazet@google.com |
---|---|
State | Accepted |
Delegated to: | David Miller |
Headers | show |
Series | [net] ipv6: fix potential crash in ip6_datagram_dst_update() | expand |
From: Eric Dumazet <edumazet@google.com> Date: Wed, 10 Jul 2019 06:40:10 -0700 > Willem forgot to change one of the calls to fl6_sock_lookup(), > which can now return an error or NULL. > > syzbot reported : ... > Fixes: 59c820b2317f ("ipv6: elide flowlabel check if no exclusive leases exist") > Signed-off-by: Eric Dumazet <edumazet@google.com> > Acked-by: Willem de Bruijn <willemb@google.com> > Reported-by: syzbot <syzkaller@googlegroups.com> Applied.
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c index 9d78c907b918a98cbb9e80154a038e31b6bddd11..9ab897ded4df52d882cda1414ef0159f3eb1765a 100644 --- a/net/ipv6/datagram.c +++ b/net/ipv6/datagram.c @@ -74,7 +74,7 @@ int ip6_datagram_dst_update(struct sock *sk, bool fix_sk_saddr) if (np->sndflow && (np->flow_label & IPV6_FLOWLABEL_MASK)) { flowlabel = fl6_sock_lookup(sk, np->flow_label); - if (!flowlabel) + if (IS_ERR(flowlabel)) return -EINVAL; } ip6_datagram_flow_key_init(&fl6, sk);