瀏覽代碼

[IPV6]: Fix crash in ip6_del_rt

ip6_null_entry doesn't have rt6i_table set, when trying to delete it the
kernel crashes dereferencing table->tb6_lock.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Patrick McHardy 19 年之前
父節點
當前提交
6c813a7297
共有 1 個文件被更改,包括 3 次插入0 次删除
  1. 3 0
      net/ipv6/route.c

+ 3 - 0
net/ipv6/route.c

@@ -1223,6 +1223,9 @@ int ip6_del_rt(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr, struct
 	int err;
 	int err;
 	struct fib6_table *table;
 	struct fib6_table *table;
 
 
+	if (rt == &ip6_null_entry)
+		return -ENOENT;
+
 	table = rt->rt6i_table;
 	table = rt->rt6i_table;
 	write_lock_bh(&table->tb6_lock);
 	write_lock_bh(&table->tb6_lock);