diff options
| author | Patrick McHardy <kaber@trash.net> | 2006-08-07 07:22:47 +0200 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2006-09-22 23:53:57 +0200 |
| commit | 6c813a7297e3af4cd7c3458e09e9ee3d161c6830 (patch) | |
| tree | f4f954814585c1e5eda070742da5a108dd2dbc19 /net/ipv6 | |
| parent | [IPV6]: Fix thinko in rt6_fill_node (diff) | |
| download | linux-6c813a7297e3af4cd7c3458e09e9ee3d161c6830.tar.xz linux-6c813a7297e3af4cd7c3458e09e9ee3d161c6830.zip | |
[IPV6]: Fix crash in ip6_del_rt
ip6_null_entry doesn't have rt6i_table set, when trying to delete it the
kernel crashes dereferencing table->tb6_lock.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6')
| -rw-r--r-- | net/ipv6/route.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/ipv6/route.c b/net/ipv6/route.c index ff5affe2636c..41c5905d3191 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -1223,6 +1223,9 @@ int ip6_del_rt(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr, struct int err; struct fib6_table *table; + if (rt == &ip6_null_entry) + return -ENOENT; + table = rt->rt6i_table; write_lock_bh(&table->tb6_lock); |