| Message ID | 20211231003635.91219-5-dsahern@kernel.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 1ff15a710a862db1101b97810af14aedc835a86a |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | net: Length checks for attributes within multipath routes | expand |
Le 31/12/2021 à 01:36, David Ahern a écrit : > Make sure RTA_GATEWAY for IPv6 multipath route has enough bytes to hold > an IPv6 address. > > Fixes: 6b9ea5a64ed5 ("ipv6: fix multipath route replace error recovery") > Signed-off-by: David Ahern <dsahern@kernel.org> > Cc: Roopa Prabhu <roopa@nvidia.com> > --- > net/ipv6/route.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/net/ipv6/route.c b/net/ipv6/route.c > index d16599c225b8..b311c0bc9983 100644 > --- a/net/ipv6/route.c > +++ b/net/ipv6/route.c > @@ -5453,7 +5453,11 @@ static int ip6_route_multipath_del(struct fib6_config *cfg, > > nla = nla_find(attrs, attrlen, RTA_GATEWAY); > if (nla) { > - nla_memcpy(&r_cfg.fc_gateway, nla, 16); > + err = fib6_gw_from_attr(&r_cfg.fc_gateway, nla, > + extack); > + if (err) > + return err; When ip6_route_del() fails, the loop continue. For consistency, maybr it could be good to do the same for this error.
diff --git a/net/ipv6/route.c b/net/ipv6/route.c index d16599c225b8..b311c0bc9983 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5453,7 +5453,11 @@ static int ip6_route_multipath_del(struct fib6_config *cfg, nla = nla_find(attrs, attrlen, RTA_GATEWAY); if (nla) { - nla_memcpy(&r_cfg.fc_gateway, nla, 16); + err = fib6_gw_from_attr(&r_cfg.fc_gateway, nla, + extack); + if (err) + return err; + r_cfg.fc_flags |= RTF_GATEWAY; } }
Make sure RTA_GATEWAY for IPv6 multipath route has enough bytes to hold an IPv6 address. Fixes: 6b9ea5a64ed5 ("ipv6: fix multipath route replace error recovery") Signed-off-by: David Ahern <dsahern@kernel.org> Cc: Roopa Prabhu <roopa@nvidia.com> --- net/ipv6/route.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)