From 11604721a3c4bea60e2ddd9e4e30d741ecdba7b0 Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Wed, 4 Jul 2012 16:13:17 -0700 Subject: [PATCH] ipv4: Fix crashes in ip_options_compile(). The spec_dst uses should be guarded by skb_rtable() being non-NULL not just the SKB being non-null. Reported-by: Eric Dumazet Signed-off-by: David S. Miller --- net/ipv4/ip_options.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c index 766dfe56..1f02251 100644 --- a/net/ipv4/ip_options.c +++ b/net/ipv4/ip_options.c @@ -253,12 +253,15 @@ int ip_options_compile(struct net *net, { __be32 spec_dst = (__force __be32) 0; unsigned char *pp_ptr = NULL; + struct rtable *rt = NULL; unsigned char *optptr; unsigned char *iph; int optlen, l; if (skb != NULL) { - spec_dst = fib_compute_spec_dst(skb); + rt = skb_rtable(skb); + if (rt) + spec_dst = fib_compute_spec_dst(skb); optptr = (unsigned char *)&(ip_hdr(skb)[1]); } else optptr = opt->__data; @@ -330,7 +333,7 @@ int ip_options_compile(struct net *net, pp_ptr = optptr + 2; goto error; } - if (skb) { + if (rt) { memcpy(&optptr[optptr[2]-1], &spec_dst, 4); opt->is_changed = 1; } @@ -372,7 +375,7 @@ int ip_options_compile(struct net *net, goto error; } opt->ts = optptr - iph; - if (skb) { + if (rt) { memcpy(&optptr[optptr[2]-1], &spec_dst, 4); timeptr = &optptr[optptr[2]+3]; } -- 2.7.4