| Message ID | 20241101035843.52230-1-03zouyi09.25@gmail.com (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | ipv6: route: fix possible null-pointer-dereference in ip6_route_info_create | expand |
On 10/31/24 9:58 PM, Yi Zou wrote: > In the ip6_route_info_create function, the variable fib6_nh is > assigned the return value of nexthop_fib6_nh(rt->nh), which could > result in fib6_nh being NULL. Immediately after this assignment, not really. IPv6 can only have nexthops in the IPv6 address family, and nexthop_mpath_select will never return NULL since `0` is always valid index if the group exists. > there is a potential dereference of fib6_nh in the following code: > if (!ipv6_addr_any(&cfg->fc_prefsrc)) { > struct net_device *dev = fib6_nh->fib_nh_dev; > This lead to a null pointer dereference (NPD) risk if fib6_nh is > NULL. The issue can be resolved by adding a NULL check before the > deference line. > > Signed-off-by: Yi Zou <03zouyi09.25@gmail.com> > --- > net/ipv6/route.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/ipv6/route.c b/net/ipv6/route.c > index b4251915585f..919592fa4e64 100644 > --- a/net/ipv6/route.c > +++ b/net/ipv6/route.c > @@ -3821,7 +3821,7 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg, > rt->fib6_flags = RTF_REJECT | RTF_NONEXTHOP; > } > > - if (!ipv6_addr_any(&cfg->fc_prefsrc)) { > + if (!ipv6_addr_any(&cfg->fc_prefsrc) && fib6_nh) { > struct net_device *dev = fib6_nh->fib_nh_dev; > > if (!ipv6_chk_addr(net, &cfg->fc_prefsrc, dev, 0)) {
diff --git a/net/ipv6/route.c b/net/ipv6/route.c index b4251915585f..919592fa4e64 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -3821,7 +3821,7 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg, rt->fib6_flags = RTF_REJECT | RTF_NONEXTHOP; } - if (!ipv6_addr_any(&cfg->fc_prefsrc)) { + if (!ipv6_addr_any(&cfg->fc_prefsrc) && fib6_nh) { struct net_device *dev = fib6_nh->fib_nh_dev; if (!ipv6_chk_addr(net, &cfg->fc_prefsrc, dev, 0)) {
In the ip6_route_info_create function, the variable fib6_nh is assigned the return value of nexthop_fib6_nh(rt->nh), which could result in fib6_nh being NULL. Immediately after this assignment, there is a potential dereference of fib6_nh in the following code: if (!ipv6_addr_any(&cfg->fc_prefsrc)) { struct net_device *dev = fib6_nh->fib_nh_dev; This lead to a null pointer dereference (NPD) risk if fib6_nh is NULL. The issue can be resolved by adding a NULL check before the deference line. Signed-off-by: Yi Zou <03zouyi09.25@gmail.com> --- net/ipv6/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)