ipv6: check for ip6_null_entry in __ip6_del_rt_siblings()
authorWANG Cong <xiyou.wangcong@gmail.com>
Tue, 28 Feb 2017 00:07:43 +0000 (16:07 -0800)
committerDavid S. Miller <davem@davemloft.net>
Thu, 2 Mar 2017 20:43:47 +0000 (12:43 -0800)
commite3330039ea28dc199e3b2da993895ff742a91adf
treee2755e80b6742c3f4b8a82464210f52c87b20e65
parent48cac18ecf1de82f76259a54402c3adb7839ad01
ipv6: check for ip6_null_entry in __ip6_del_rt_siblings()

Andrey reported a NULL pointer deref bug in ipv6_route_ioctl()
-> ip6_route_del() -> __ip6_del_rt_siblings() code path. This is
because ip6_null_entry is returned in this path since ip6_null_entry
is kinda default for a ipv6 route table root node. Quote from
David Ahern:

 ip6_null_entry is the root of all ipv6 fib tables making it integrated
 into the table ...

We should ignore any attempt of trying to delete it, like we do in
__ip6_del_rt() path and several others.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Fixes: 0ae8133586ad ("net: ipv6: Allow shorthand delete of all nexthops in multipath route")
Cc: David Ahern <dsa@cumulusnetworks.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv6/route.c