0029-ipv6-fix-crash-on-ICMPv6-redirects-with-prohibited-blackholed-source.patch 2.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657
  1. From: Matthias Schiffer <mschiffer@universe-factory.net>
  2. Date: Mon, 2 Nov 2015 02:02:02 +0100
  3. Subject: ipv6: fix crash on ICMPv6 redirects with prohibited/blackholed source
  4. There are other error values besides ip6_null_entry that can be returned by
  5. ip6_route_redirect(): fib6_rule_action() can also result in
  6. ip6_blk_hole_entry and ip6_prohibit_entry if such ip rules are installed.
  7. Only checking for ip6_null_entry in rt6_do_redirect() causes ip6_ins_rt()
  8. to be called with rt->rt6i_table == NULL in these cases, making the kernel
  9. crash.
  10. diff --git a/target/linux/generic/patches-3.18/672-ipv6-fix-crash-on-ICMPv6-redirects-with-prohibited-blackholed-source.patch b/target/linux/generic/patches-3.18/672-ipv6-fix-crash-on-ICMPv6-redirects-with-prohibited-blackholed-source.patch
  11. new file mode 100644
  12. index 0000000..6e4b3da
  13. --- /dev/null
  14. +++ b/target/linux/generic/patches-3.18/672-ipv6-fix-crash-on-ICMPv6-redirects-with-prohibited-blackholed-source.patch
  15. @@ -0,0 +1,39 @@
  16. +From 7426eb388ade0f1ad800c408d7efa227d4f41408 Mon Sep 17 00:00:00 2001
  17. +Message-Id: <7426eb388ade0f1ad800c408d7efa227d4f41408.1446425986.git.mschiffer@universe-factory.net>
  18. +From: Matthias Schiffer <mschiffer@universe-factory.net>
  19. +Date: Mon, 2 Nov 2015 01:05:15 +0100
  20. +Subject: [PATCH] ipv6: fix crash on ICMPv6 redirects with
  21. + prohibited/blackholed source
  22. +
  23. +There are other error values besides ip6_null_entry that can be returned by
  24. +ip6_route_redirect(): fib6_rule_action() can also result in
  25. +ip6_blk_hole_entry and ip6_prohibit_entry if such ip rules are installed.
  26. +
  27. +Only checking for ip6_null_entry in rt6_do_redirect() causes ip6_ins_rt()
  28. +to be called with rt->rt6i_table == NULL in these cases, making the kernel
  29. +crash.
  30. +
  31. +Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
  32. +---
  33. + net/ipv6/route.c | 3 +--
  34. + 1 file changed, 1 insertion(+), 2 deletions(-)
  35. +
  36. +--- a/net/ipv6/route.c
  37. ++++ b/net/ipv6/route.c
  38. +@@ -1766,7 +1766,6 @@ static int ip6_route_del(struct fib6_con
  39. +
  40. + static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buff *skb)
  41. + {
  42. +- struct net *net = dev_net(skb->dev);
  43. + struct netevent_redirect netevent;
  44. + struct rt6_info *rt, *nrt = NULL;
  45. + struct ndisc_options ndopts;
  46. +@@ -1827,7 +1826,7 @@ static void rt6_do_redirect(struct dst_e
  47. + }
  48. +
  49. + rt = (struct rt6_info *) dst;
  50. +- if (rt == net->ipv6.ip6_null_entry) {
  51. ++ if (rt->rt6i_flags & RTF_REJECT) {
  52. + net_dbg_ratelimited("rt6_redirect: source isn't a valid nexthop for redirect target\n");
  53. + return;
  54. + }