[PATCH] fix NULL pointer Oops in fib(6)_rule_suppress

[PATCH] fix NULL pointer Oops in fib(6)_rule_suppress

[Stefan Tomanek]

Reported-by: Daniel Golle <daniel.golle@gmail.com>
Tested-by: Daniel Golle <daniel.golle@gmail.com>
Signed-off-by: Stefan Tomanek <stefan.tomanek@wertarbyte.de>
---
 net/ipv4/fib_rules.c  |    4 +++-
 net/ipv6/fib6_rules.c |    5 ++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index 523be38..4e1c1e5 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -104,7 +104,9 @@ errout:
 static bool fib4_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg)
 {
 	struct fib_result *result = (struct fib_result *) arg->result;
-	struct net_device *dev = result->fi->fib_dev;
+	struct net_device *dev = NULL;
+	if (result->fi)
+		dev = result->fi->fib_dev;
 
 	/* do not accept result if the route does
 	 * not meet the required prefix length
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index e275916..43e45b5 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -122,7 +122,10 @@ out:
 static bool fib6_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg)
 {
 	struct rt6_info *rt = (struct rt6_info *) arg->result;
-	struct net_device *dev = rt->rt6i_idev->dev;
+	struct net_device *dev = NULL;
+	if (rt->rt6i_idev)
+		dev = rt->rt6i_idev->dev;
+
 	/* do not accept result if the route does
 	 * not meet the required prefix length
 	 */
-- 
1.7.10.4

Re: [PATCH] fix NULL pointer Oops in fib(6)_rule_suppress

[Sergei Shtylyov]

Hello.

On 17-11-2013 15:14, Stefan Tomanek wrote:

> Reported-by: Daniel Golle <daniel.golle@gmail.com>
> Tested-by: Daniel Golle <daniel.golle@gmail.com>
> Signed-off-by: Stefan Tomanek <stefan.tomanek@wertarbyte.de>
> ---
>   net/ipv4/fib_rules.c  |    4 +++-
>   net/ipv6/fib6_rules.c |    5 ++++-
>   2 files changed, 7 insertions(+), 2 deletions(-)

> diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
> index 523be38..4e1c1e5 100644
> --- a/net/ipv4/fib_rules.c
> +++ b/net/ipv4/fib_rules.c
> @@ -104,7 +104,9 @@ errout:
>   static bool fib4_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg)
>   {
>   	struct fib_result *result = (struct fib_result *) arg->result;
> -	struct net_device *dev = result->fi->fib_dev;
> +	struct net_device *dev = NULL;

    Please leave empty line after declarations, like it was before your patch.

> +	if (result->fi)
> +		dev = result->fi->fib_dev;
>
>   	/* do not accept result if the route does
>   	 * not meet the required prefix length
> diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
> index e275916..43e45b5 100644
> --- a/net/ipv6/fib6_rules.c
> +++ b/net/ipv6/fib6_rules.c
> @@ -122,7 +122,10 @@ out:
>   static bool fib6_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg)
>   {
>   	struct rt6_info *rt = (struct rt6_info *) arg->result;
> -	struct net_device *dev = rt->rt6i_idev->dev;
> +	struct net_device *dev = NULL;

    Same here.

> +	if (rt->rt6i_idev)
> +		dev = rt->rt6i_idev->dev;
> +

WBR, Sergei

[PATCH v2] fix possible NULL pointer Oops in fib(6)_rule_suppress

[Stefan Tomanek]

Reported-by: Daniel Golle <daniel.golle@gmail.com>
Tested-by: Daniel Golle <daniel.golle@gmail.com>
Signed-off-by: Stefan Tomanek <stefan.tomanek@wertarbyte.de>
---
 net/ipv4/fib_rules.c  |    5 ++++-
 net/ipv6/fib6_rules.c |    6 +++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index 523be38..f2e1573 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -104,7 +104,10 @@ errout:
 static bool fib4_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg)
 {
 	struct fib_result *result = (struct fib_result *) arg->result;
-	struct net_device *dev = result->fi->fib_dev;
+	struct net_device *dev = NULL;
+
+	if (result->fi)
+		dev = result->fi->fib_dev;
 
 	/* do not accept result if the route does
 	 * not meet the required prefix length
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index e275916..3fd0a57 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -122,7 +122,11 @@ out:
 static bool fib6_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg)
 {
 	struct rt6_info *rt = (struct rt6_info *) arg->result;
-	struct net_device *dev = rt->rt6i_idev->dev;
+	struct net_device *dev = NULL;
+
+	if (rt->rt6i_idev)
+		dev = rt->rt6i_idev->dev;
+
 	/* do not accept result if the route does
 	 * not meet the required prefix length
 	 */
-- 
1.7.10.4

Re: [PATCH v2] fix possible NULL pointer Oops in fib(6)_rule_suppress

[David Miller]

From: Stefan Tomanek <stefan.tomanek@wertarbyte.de>
Date: Sun, 17 Nov 2013 15:45:01 +0100

> Reported-by: Daniel Golle <daniel.golle@gmail.com>
> Tested-by: Daniel Golle <daniel.golle@gmail.com>
> Signed-off-by: Stefan Tomanek <stefan.tomanek@wertarbyte.de>

Please us an appropriate subsystem prefix in your Subject lines, otherwise
the commit message header is less useful for others scanning the commit
log.

"inet: " would work well in this case.