Messages in this thread Patch in this message | | | From | Gaurav Singh <> | Subject | [PATCH] [net/ipv6] ip6_output: Add ipv6_pinfo null check | Date | Sat, 8 Aug 2020 13:06:52 -0400 |
| |
This PR fixes a possible segmentation violation.
In function: ip6_xmit(), we have const struct ipv6_pinfo *np = inet6_sk(sk); which returns NULL unconditionally (regardless sk being NULL or not).
In include/linux/ipv6.h:
static inline struct ipv6_pinfo * inet6_sk(const struct sock *__sk) { return NULL; }
Further down the function, there's a check: if (np) hlimit = hp->htop_limit
Thereafter, we have a call ip6_flow_hdr(hdr, tclass, ip6_make_flowlabel(net, skb, fl6->flowlabel, ip6_autoflowlabel(net, np), fl6));
Hence np = NULL gets passed in the function ip6_autoflowlabel() that accesses np without check which may cause a segment violation.
Fixes: 513674b5a2c9c ("net: reevalulate autoflowlabel setting after sysctl setting")
Signed-off-by: Gaurav Singh <gaurav1086@gmail.com> --- net/ipv6/ip6_output.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 8a8c2d0cfcc8..94a07c9bd925 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -181,10 +181,10 @@ int ip6_output(struct net *net, struct sock *sk, struct sk_buff *skb) bool ip6_autoflowlabel(struct net *net, const struct ipv6_pinfo *np) { - if (!np->autoflowlabel_set) - return ip6_default_np_autolabel(net); - else + if (np && np->autoflowlabel_set) return np->autoflowlabel; + else + return ip6_default_np_autolabel(net); } /* -- 2.17.1
| |