ip6_null_entry doesn't have rt6i_table set, when trying to delete it the kernel crashes dereferencing table->tb6_lock. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
@@ -1223,6 +1223,9 @@ int ip6_del_rt(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr, struct
int err;
struct fib6_table *table;
+ if (rt == &ip6_null_entry)
+ return -ENOENT;
+
table = rt->rt6i_table;
write_lock_bh(&table->tb6_lock);