Commit 773a69d6 authored Jul 21, 2015 by Thomas Graf Committed by David S. Miller Jul 21, 2015

icmp: Don't leak original dst into ip_route_input()



ip_route_input() unconditionally overwrites the dst. Hide the original
dst attached to the skb by calling skb_dst_set(skb, NULL) prior to
ip_route_input().

Reported-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 1d8fff90

net/ipv4/icmp.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -496,6 +496,7 @@ static struct rtable icmp_route_lookup(struct net net,
		}
		/* Ugh! */
		orefdst = skb_in->_skb_refdst; /* save old refdst */
		skb_dst_set(skb_in, NULL);
		err = ip_route_input(skb_in, fl4_dec.daddr, fl4_dec.saddr,
		RT_TOS(tos), rt2->dst.dev);