Skip to contentSkip to conversation

: Fix crash in ip6_del_rt

IPV6 Applied Patrick McHardy 2 participants 2 messages Aug 7, 2006

Subsystems (3)
lore
Share & tools
lore
#0 lore raw

[IPV6]: Fix crash in ip6_del_rt

ip6_null_entry doesn't have rt6i_table set, when trying to delete it the kernel crashes dereferencing table->tb6_lock.

---
commit d3ddd45b230e8b56873c77d266004fec49c44f8b
tree 764a548789cd495e2b424824c682734f62e9cb94
parent 10365c03ef65f5bccc992d6b78f7ef037cb4f0e9
author Patrick McHardy <[email protected]> Mon, 07 Aug 2006 06:54:47 +0200 committer Patrick McHardy <[email protected]> Mon, 07 Aug 2006 06:54:47 +0200

 net/ipv6/route.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)
net/ipv6/route.c +3 -0
index d5c39c4..c6c3cf3 100644
@@ -1223,6 +1223,9 @@ int ip6_del_rt(struct rt6_info *rt, stru
 	int err;
 	struct fib6_table *table;
 
+	if (rt == &ip6_null_entry)
+		return -ENOENT;
+
 	table = rt->rt6i_table;
 	write_lock_bh(&table->tb6_lock);
 
maintainer Applied
#1 lore raw

From: Patrick McHardy <[email protected]>
Date: Mon, 07 Aug 2006 07:19:05 +0200

Quoted 6 lines

[IPV6]: Fix crash in ip6_del_rt

ip6_null_entry doesn't have rt6i_table set, when trying to delete it the kernel crashes dereferencing table->tb6_lock.

Applied, thanks Patrick.