From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jakub Sitnicki Subject: [iproute PATCH] iproute: Abort if nexthop cannot be parsed Date: Wed, 11 Apr 2018 11:43:11 +0200 Message-ID: <20180411094311.21097-1-jkbs@redhat.com> Cc: netdev@vger.kernel.org To: Stephen Hemminger Return-path: Received: from mail-pl0-f68.google.com ([209.85.160.68]:43535 "EHLO mail-pl0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751758AbeDKJnS (ORCPT ); Wed, 11 Apr 2018 05:43:18 -0400 Received: by mail-pl0-f68.google.com with SMTP id a39-v6so984148pla.10 for ; Wed, 11 Apr 2018 02:43:18 -0700 (PDT) Sender: netdev-owner@vger.kernel.org List-ID: Attempt to add a multipath route where a nexthop definition refers to a non-existent device causes 'ip' to crash and burn due to stack buffer overflow: # ip -6 route add fd00::1/64 nexthop dev fake1 Cannot find device "fake1" Cannot find device "fake1" Cannot find device "fake1" ... Segmentation fault (core dumped) Don't ignore errors from the helper routine that parses the nexthop definition, and abort immediately if parsing fails. Signed-off-by: Jakub Sitnicki --- ip/iproute.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ip/iproute.c b/ip/iproute.c index 1d8fd815..44351bc5 100644 --- a/ip/iproute.c +++ b/ip/iproute.c @@ -1038,7 +1038,10 @@ static int parse_nexthops(struct nlmsghdr *n, struct rtmsg *r, memset(rtnh, 0, sizeof(*rtnh)); rtnh->rtnh_len = sizeof(*rtnh); rta->rta_len += rtnh->rtnh_len; - parse_one_nh(n, r, rta, rtnh, &argc, &argv); + if (parse_one_nh(n, r, rta, rtnh, &argc, &argv)) { + fprintf(stderr, "Error: cannot parse nexthop\n"); + exit(-1); + } rtnh = RTNH_NEXT(rtnh); } -- 2.14.3