diff options
| author | Patrick McHardy <kaber@trash.net> | 2006-08-06 22:22:47 -0700 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2006-09-22 14:53:57 -0700 |
| commit | 6c813a7297e3af4cd7c3458e09e9ee3d161c6830 (patch) | |
| tree | f4f954814585c1e5eda070742da5a108dd2dbc19 | |
| parent | d7aba67f814729647c938ac6da2d5224b790f926 (diff) | |
| download | linux-3.10-6c813a7297e3af4cd7c3458e09e9ee3d161c6830.tar.gz linux-3.10-6c813a7297e3af4cd7c3458e09e9ee3d161c6830.tar.bz2 linux-3.10-6c813a7297e3af4cd7c3458e09e9ee3d161c6830.zip | |
[IPV6]: Fix crash in ip6_del_rt
ip6_null_entry doesn't have rt6i_table set, when trying to delete it the
kernel crashes dereferencing table->tb6_lock.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/ipv6/route.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/ipv6/route.c b/net/ipv6/route.c index ff5affe2636..41c5905d319 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -1223,6 +1223,9 @@ int ip6_del_rt(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr, struct int err; struct fib6_table *table; + if (rt == &ip6_null_entry) + return -ENOENT; + table = rt->rt6i_table; write_lock_bh(&table->tb6_lock); |