Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 11604721 authored by David S. Miller's avatar David S. Miller
Browse files

ipv4: Fix crashes in ip_options_compile(). 



The spec_dst uses should be guarded by skb_rtable() being non-NULL
not just the SKB being non-null.

Reported-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e87183c2

net/ipv4/ip_options.c

+6 −3
Original line number Diff line number Diff line
@@ -253,11 +253,14 @@ int ip_options_compile(struct net *net, 
{

	__be32 spec_dst = (__force __be32) 0;

	unsigned char *pp_ptr = NULL;

	struct rtable *rt = NULL;

	unsigned char *optptr;

	unsigned char *iph;

	int optlen, l;



	if (skb != NULL) {

		rt = skb_rtable(skb);

		if (rt)

			spec_dst = fib_compute_spec_dst(skb);

		optptr = (unsigned char *)&(ip_hdr(skb)[1]);

	} else
@@ -330,7 +333,7 @@ int ip_options_compile(struct net *net, 
					pp_ptr = optptr + 2;

					goto error;

				}

				if (skb) {

				if (rt) {

					memcpy(&optptr[optptr[2]-1], &spec_dst, 4);

					opt->is_changed = 1;

				}
@@ -372,7 +375,7 @@ int ip_options_compile(struct net *net, 
						goto error;

					}

					opt->ts = optptr - iph;

					if (skb)  {

					if (rt)  {

						memcpy(&optptr[optptr[2]-1], &spec_dst, 4);

						timeptr = &optptr[optptr[2]+3];

					}