Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c0b8da1e authored by YOSHIFUJI Hideaki/吉藤英明's avatar YOSHIFUJI Hideaki/吉藤英明 Committed by David S. Miller
Browse files

ipv6: Fix finding best source address in ipv6_dev_get_saddr(). 



Commit 9131f3de ("ipv6: Do not iterate over all interfaces when
finding source address on specific interface.") did not properly
update best source address available.  Plus, it introduced
possible NULL pointer dereference.

Bug was reported by Erik Kline <ek@google.com>.
Based on patch proposed by Hajime Tazaki <thehajime@gmail.com>.

Fixes: 9131f3de ("ipv6: Do not
	iterate over all interfaces when finding source address
	on specific interface.")
Signed-off-by: default avatarYOSHIFUJI Hideaki <hideaki.yoshifuji@miraclelinux.com>
Acked-by: default avatarHajime Tazaki <thehajime@gmail.com>
Acked-by: default avatarErik Kline <ek@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9243b25b

net/ipv6/addrconf.c

+18 −12
Original line number Diff line number Diff line
@@ -1358,14 +1358,15 @@ static int ipv6_get_saddr_eval(struct net *net, 
	return ret;

}



static void __ipv6_dev_get_saddr(struct net *net,

static int __ipv6_dev_get_saddr(struct net *net,

				struct ipv6_saddr_dst *dst,

				unsigned int prefs,

				const struct in6_addr *saddr,

				struct inet6_dev *idev,

				 struct ipv6_saddr_score *scores)

				struct ipv6_saddr_score *scores,

				int hiscore_idx)

{

	struct ipv6_saddr_score *score = &scores[0], *hiscore = &scores[1];

	struct ipv6_saddr_score *score = &scores[1 - hiscore_idx], *hiscore = &scores[hiscore_idx];



	read_lock_bh(&idev->lock);

	list_for_each_entry(score->ifa, &idev->addr_list, if_list) {
@@ -1424,6 +1425,7 @@ static void __ipv6_dev_get_saddr(struct net *net, 
				in6_ifa_hold(score->ifa);



				swap(hiscore, score);

				hiscore_idx = 1 - hiscore_idx;



				/* restore our iterator */

				score->ifa = hiscore->ifa;
@@ -1434,18 +1436,20 @@ static void __ipv6_dev_get_saddr(struct net *net, 
	}

out:

	read_unlock_bh(&idev->lock);

	return hiscore_idx;

}



int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,

		       const struct in6_addr *daddr, unsigned int prefs,

		       struct in6_addr *saddr)

{

	struct ipv6_saddr_score scores[2], *hiscore = &scores[1];

	struct ipv6_saddr_score scores[2], *hiscore;

	struct ipv6_saddr_dst dst;

	struct inet6_dev *idev;

	struct net_device *dev;

	int dst_type;

	bool use_oif_addr = false;

	int hiscore_idx = 0;



	dst_type = __ipv6_addr_type(daddr);

	dst.addr = daddr;
@@ -1454,8 +1458,8 @@ int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev, 
	dst.label = ipv6_addr_label(net, daddr, dst_type, dst.ifindex);

	dst.prefs = prefs;



	hiscore->rule = -1;

	hiscore->ifa = NULL;

	scores[hiscore_idx].rule = -1;

	scores[hiscore_idx].ifa = NULL;



	rcu_read_lock();
@@ -1480,17 +1484,19 @@ int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev, 
	}



	if (use_oif_addr) {

		__ipv6_dev_get_saddr(net, &dst, prefs, saddr, idev, scores);

		if (idev)

			hiscore_idx = __ipv6_dev_get_saddr(net, &dst, prefs, saddr, idev, scores, hiscore_idx);

	} else {

		for_each_netdev_rcu(net, dev) {

			idev = __in6_dev_get(dev);

			if (!idev)

				continue;

			__ipv6_dev_get_saddr(net, &dst, prefs, saddr, idev, scores);

			hiscore_idx = __ipv6_dev_get_saddr(net, &dst, prefs, saddr, idev, scores, hiscore_idx);

		}

	}

	rcu_read_unlock();



	hiscore = &scores[hiscore_idx];

	if (!hiscore->ifa)

		return -EADDRNOTAVAIL;