| Message ID | 20241101035843.52230-1-03zouyi09.25@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | ipv6: route: fix possible null-pointer-dereference in ip6_route_info_create | expand |
diff --git a/net/ipv6/route.c b/net/ipv6/route.c index b4251915585f..919592fa4e64 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -3821,7 +3821,7 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg, rt->fib6_flags = RTF_REJECT | RTF_NONEXTHOP; } - if (!ipv6_addr_any(&cfg->fc_prefsrc)) { + if (!ipv6_addr_any(&cfg->fc_prefsrc) && fib6_nh) { struct net_device *dev = fib6_nh->fib_nh_dev; if (!ipv6_chk_addr(net, &cfg->fc_prefsrc, dev, 0)) {
In the ip6_route_info_create function, the variable fib6_nh is assigned the return value of nexthop_fib6_nh(rt->nh), which could result in fib6_nh being NULL. Immediately after this assignment, there is a potential dereference of fib6_nh in the following code: if (!ipv6_addr_any(&cfg->fc_prefsrc)) { struct net_device *dev = fib6_nh->fib_nh_dev; This lead to a null pointer dereference (NPD) risk if fib6_nh is NULL. The issue can be resolved by adding a NULL check before the deference line. Signed-off-by: Yi Zou <03zouyi09.25@gmail.com> --- net/ipv6/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)