| Message ID | 20200808170653.8515-1-gaurav1086@gmail.com |
|---|---|
| State | Rejected |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net/ipv6] ip6_output: Add ipv6_pinfo null check | expand |
On Sat, Aug 8, 2020 at 10:07 AM Gaurav Singh <gaurav1086@gmail.com> wrote: > > This PR fixes a possible segmentation violation. > > In function: ip6_xmit(), we have > const struct ipv6_pinfo *np = inet6_sk(sk); which returns NULL > unconditionally (regardless sk being NULL or not). > > In include/linux/ipv6.h: > > static inline struct ipv6_pinfo * inet6_sk(const struct sock *__sk) > { > return NULL; > } > Tell us who will use ip6_autoflowlabel() when CONFIG_IPV6 is disabled. :)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 8a8c2d0cfcc8..94a07c9bd925 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -181,10 +181,10 @@ int ip6_output(struct net *net, struct sock *sk, struct sk_buff *skb) bool ip6_autoflowlabel(struct net *net, const struct ipv6_pinfo *np) { - if (!np->autoflowlabel_set) - return ip6_default_np_autolabel(net); - else + if (np && np->autoflowlabel_set) return np->autoflowlabel; + else + return ip6_default_np_autolabel(net); } /*
This PR fixes a possible segmentation violation. In function: ip6_xmit(), we have const struct ipv6_pinfo *np = inet6_sk(sk); which returns NULL unconditionally (regardless sk being NULL or not). In include/linux/ipv6.h: static inline struct ipv6_pinfo * inet6_sk(const struct sock *__sk) { return NULL; } Further down the function, there's a check: if (np) hlimit = hp->htop_limit Thereafter, we have a call ip6_flow_hdr(hdr, tclass, ip6_make_flowlabel(net, skb, fl6->flowlabel, ip6_autoflowlabel(net, np), fl6)); Hence np = NULL gets passed in the function ip6_autoflowlabel() that accesses np without check which may cause a segment violation. Fixes: 513674b5a2c9c ("net: reevalulate autoflowlabel setting after sysctl setting") Signed-off-by: Gaurav Singh <gaurav1086@gmail.com> --- net/ipv6/ip6_output.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)