Skip to content

Commit

Permalink
[IPV6]: Fix crash in ip6_del_rt
Browse files Browse the repository at this point in the history
ip6_null_entry doesn't have rt6i_table set, when trying to delete it the
kernel crashes dereferencing table->tb6_lock.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Patrick McHardy authored and David S. Miller committed Sep 22, 2006
1 parent d7aba67 commit 6c813a7
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions net/ipv6/route.c
Original file line number Diff line number Diff line change
Expand Up @@ -1223,6 +1223,9 @@ int ip6_del_rt(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr, struct
int err;
struct fib6_table *table;

if (rt == &ip6_null_entry)
return -ENOENT;

table = rt->rt6i_table;
write_lock_bh(&table->tb6_lock);

Expand Down

0 comments on commit 6c813a7

Please sign in to comment.