Commit 86cccd23 authored Dec 23, 2016 by Lorenzo Colitti Committed by Amit Pundir Apr 14, 2017

UPSTREAM: net: ipv4: Don't crash if passing a null sk to ip_do_redirect.



Commit e2d118a1cb5e ("net: inet: Support UID-based routing in IP
protocols.") made ip_do_redirect call sock_net(sk) to determine
the network namespace of the passed-in socket. This crashes if sk
is NULL.

Fix this by getting the network namespace from the skb instead.

Fixes: e2d118a1cb5e ("net: inet: Support UID-based routing in IP protocols.")
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Fixes: android-4.9 commitID 5044292c
       ("UPSTREAM: net: inet: Support UID-based routing in IP protocols.")
(cherry picked from commit 7d99569460eae28b187d574aec930a4cf8b90441)
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

parent 75777a75

net/ipv4/route.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -798,6 +798,7 @@ static void ip_do_redirect(struct dst_entry dst, struct sock sk, struct sk_buf
		struct rtable *rt;
		struct flowi4 fl4;
		const struct iphdr iph = (const struct iphdr ) skb->data;
		struct net *net = dev_net(skb->dev);
		int oif = skb->dev->ifindex;
		u8 tos = RT_TOS(iph->tos);
		u8 prot = iph->protocol;
		@@ -805,7 +806,7 @@ static void ip_do_redirect(struct dst_entry dst, struct sock sk, struct sk_buf

		rt = (struct rtable *) dst;

		__build_flow_key(sock_net(sk), &fl4, sk, iph, oif, tos, prot, mark, 0);
		__build_flow_key(net, &fl4, sk, iph, oif, tos, prot, mark, 0);
		__ip_do_redirect(rt, skb, &fl4, true);
		}