Commit 13e55fba authored by Justin Iurman's avatar Justin Iurman Committed by Paolo Abeni
Browse files

net: ipv6: fix dst ref loop on input in rpl lwt 



Prevent a dst ref loop on input in rpl_iptunnel.

Fixes: a7a29f9c ("net: ipv6: add rpl sr tunnel")
Cc: Alexander Aring <alex.aring@gmail.com>
Cc: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: default avatarIdo Schimmel <idosch@nvidia.com>
Signed-off-by: default avatarJustin Iurman <justin.iurman@uliege.be>
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent c64a0727

net/ipv6/rpl_iptunnel.c

+12 −2
Original line number Diff line number Diff line
@@ -262,10 +262,18 @@ static int rpl_input(struct sk_buff *skb) 
{

	struct dst_entry *orig_dst = skb_dst(skb);

	struct dst_entry *dst = NULL;

	struct lwtunnel_state *lwtst;

	struct rpl_lwt *rlwt;

	int err;



	rlwt = rpl_lwt_lwtunnel(orig_dst->lwtstate);

	/* We cannot dereference "orig_dst" once ip6_route_input() or

	 * skb_dst_drop() is called. However, in order to detect a dst loop, we

	 * need the address of its lwtstate. So, save the address of lwtstate

	 * now and use it later as a comparison.

	 */

	lwtst = orig_dst->lwtstate;



	rlwt = rpl_lwt_lwtunnel(lwtst);



	local_bh_disable();

	dst = dst_cache_get(&rlwt->cache);
@@ -280,7 +288,9 @@ static int rpl_input(struct sk_buff *skb) 
	if (!dst) {

		ip6_route_input(skb);

		dst = skb_dst(skb);

		if (!dst->error) {



		/* cache only if we don't create a dst reference loop */

		if (!dst->error && lwtst != dst->lwtstate) {

			local_bh_disable();

			dst_cache_set_ip6(&rlwt->cache, dst,

					  &ipv6_hdr(skb)->saddr);