Commit 6c813a72 authored Aug 06, 2006 by Patrick McHardy Committed by David S. Miller Sep 22, 2006

[IPV6]: Fix crash in ip6_del_rt



ip6_null_entry doesn't have rt6i_table set, when trying to delete it the
kernel crashes dereferencing table->tb6_lock.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent d7aba67f

net/ipv6/route.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -1223,6 +1223,9 @@ int ip6_del_rt(struct rt6_info rt, struct nlmsghdr nlh, void *_rtattr, struct
		int err;
		struct fib6_table *table;

		if (rt == &ip6_null_entry)
		return -ENOENT;

		table = rt->rt6i_table;
		write_lock_bh(&table->tb6_lock);