This is a note to let you know that I've just added the patch titled
inet: fix NULL pointer Oops in fib(6)_rule_suppress
to the 3.12-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
inet-fix-null-pointer-oops-in-fib-6-_rule_suppress.patch
and it can be found in the queue-3.12 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From foo@baz Mon Jan 13 09:44:41 PST 2014
From: Stefan Tomanek <stefan.tomanek@xxxxxxxxxxxxx>
Date: Tue, 10 Dec 2013 23:21:25 +0100
Subject: inet: fix NULL pointer Oops in fib(6)_rule_suppress
From: Stefan Tomanek <stefan.tomanek@xxxxxxxxxxxxx>
[ Upstream commit 673498b8ed4c4d4b7221c5309d891c5eac2b7528 ]
This changes ensures that the routing entry investigated by the suppress
function actually does point to a device struct before following that pointer,
fixing a possible kernel oops situation when verifying the interface group
associated with a routing table entry.
According to Daniel Golle, this Oops can be triggered by a user process trying
to establish an outgoing IPv6 connection while having no real IPv6 connectivity
set up (only autoassigned link-local addresses).
Fixes: 6ef94cfafba15 ("fib_rules: add route suppression based on ifgroup")
Reported-by: Daniel Golle <daniel.golle@xxxxxxxxx>
Tested-by: Daniel Golle <daniel.golle@xxxxxxxxx>
Signed-off-by: Stefan Tomanek <stefan.tomanek@xxxxxxxxxxxxx>
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/ipv4/fib_rules.c | 5 ++++-
net/ipv6/fib6_rules.c | 6 +++++-
2 files changed, 9 insertions(+), 2 deletions(-)
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -104,7 +104,10 @@ errout:
static bool fib4_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg)
{
struct fib_result *result = (struct fib_result *) arg->result;
- struct net_device *dev = result->fi->fib_dev;
+ struct net_device *dev = NULL;
+
+ if (result->fi)
+ dev = result->fi->fib_dev;
/* do not accept result if the route does
* not meet the required prefix length
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -122,7 +122,11 @@ out:
static bool fib6_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg)
{
struct rt6_info *rt = (struct rt6_info *) arg->result;
- struct net_device *dev = rt->rt6i_idev->dev;
+ struct net_device *dev = NULL;
+
+ if (rt->rt6i_idev)
+ dev = rt->rt6i_idev->dev;
+
/* do not accept result if the route does
* not meet the required prefix length
*/
Patches currently in stable-queue which might be from stefan.tomanek@xxxxxxxxxxxxx are
queue-3.12/inet-fix-null-pointer-oops-in-fib-6-_rule_suppress.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html