[PATCH net-next] ipv6: check fn before doing FIB6_SUBTREE(fn)

[PATCH net-next] ipv6: check fn before doing FIB6_SUBTREE(fn)

[Wei Wang]

From: Wei Wang <weiwan@google.com>

In fib6_locate(), we need to first make sure fn is not NULL before doing
FIB6_SUBTREE(fn) to avoid crash.

This fixes the following static checker warning:
net/ipv6/ip6_fib.c:1462 fib6_locate()
         warn: variable dereferenced before check 'fn' (see line 1459)

net/ipv6/ip6_fib.c
  1458          if (src_len) {
  1459                  struct fib6_node *subtree = FIB6_SUBTREE(fn);
                                                    ^^^^^^^^^^^^^^^^
We shifted this dereference

  1460
  1461                  WARN_ON(saddr == NULL);
  1462                  if (fn && subtree)
                            ^^
before the check for NULL.

  1463                          fn = fib6_locate_1(subtree, saddr, src_len,
  1464                                             offsetof(struct rt6_info, rt6i_src)

Fixes: 66f5d6ce53e6 ("ipv6: replace rwlock with rcu and spinlock in fib6_table")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Wei Wang <weiwan@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
---
 net/ipv6/ip6_fib.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index c2ecd5ec638a..548af48212fc 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1456,13 +1456,16 @@ struct fib6_node *fib6_locate(struct fib6_node *root,
 
 #ifdef CONFIG_IPV6_SUBTREES
 	if (src_len) {
-		struct fib6_node *subtree = FIB6_SUBTREE(fn);
-
 		WARN_ON(saddr == NULL);
-		if (fn && subtree)
-			fn = fib6_locate_1(subtree, saddr, src_len,
+		if (fn) {
+			struct fib6_node *subtree = FIB6_SUBTREE(fn);
+
+			if (subtree) {
+				fn = fib6_locate_1(subtree, saddr, src_len,
 					   offsetof(struct rt6_info, rt6i_src),
 					   exact_match);
+			}
+		}
 	}
 #endif
 
-- 
2.15.0.rc0.271.g36b669edcc-goog

Re: [PATCH net-next] ipv6: check fn before doing FIB6_SUBTREE(fn)

[Martin KaFai Lau]

On Fri, Oct 13, 2017 at 10:01:08PM +0000, Wei Wang wrote:
> From: Wei Wang <weiwan@google.com>
> 
> In fib6_locate(), we need to first make sure fn is not NULL before doing
> FIB6_SUBTREE(fn) to avoid crash.
Acked-by: Martin KaFai Lau <kafai@fb.com>

Re: [PATCH net-next] ipv6: check fn before doing FIB6_SUBTREE(fn)

[David Miller]

From: Wei Wang <weiwan@google.com>
Date: Fri, 13 Oct 2017 15:01:08 -0700

> From: Wei Wang <weiwan@google.com>
> 
> In fib6_locate(), we need to first make sure fn is not NULL before doing
> FIB6_SUBTREE(fn) to avoid crash.
> 
> This fixes the following static checker warning:
> net/ipv6/ip6_fib.c:1462 fib6_locate()
>          warn: variable dereferenced before check 'fn' (see line 1459)
> 
> net/ipv6/ip6_fib.c
>   1458          if (src_len) {
>   1459                  struct fib6_node *subtree = FIB6_SUBTREE(fn);
>                                                     ^^^^^^^^^^^^^^^^
> We shifted this dereference
> 
>   1460
>   1461                  WARN_ON(saddr == NULL);
>   1462                  if (fn && subtree)
>                             ^^
> before the check for NULL.
> 
>   1463                          fn = fib6_locate_1(subtree, saddr, src_len,
>   1464                                             offsetof(struct rt6_info, rt6i_src)
> 
> Fixes: 66f5d6ce53e6 ("ipv6: replace rwlock with rcu and spinlock in fib6_table")
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Wei Wang <weiwan@google.com>
> Acked-by: Eric Dumazet <edumazet@google.com>

Applied.