path: root/net
diff options
authorHangbin Liu <>2019-08-22 22:19:48 +0800
committerDavid S. Miller <>2019-08-24 14:49:35 -0700
commite2c693934194fd3b4e795635934883354c06ebc9 (patch)
treeb9c0f92ecb35d8917b72ed9151c0aad765c08ae0 /net
parent12c6bc38f99bb168b7f16bdb5e855a51a23ee9ec (diff)
ipv4/icmp: fix rt dst dev null pointer dereference
In __icmp_send() there is a possibility that the rt-> is NULL, e,g, with tunnel collect_md mode, which will cause kernel crash. Here is what the code path looks like, for GRE: - ip6gre_tunnel_xmit - ip6gre_xmit_ipv4 - __gre6_xmit - ip6_tnl_xmit - if skb->len - t->tun_hlen - eth_hlen > mtu; return -EMSGSIZE - icmp_send - net = dev_net(rt->; <-- here The reason is __metadata_dst_init() init dst->dev to NULL by default. We could not fix it in __metadata_dst_init() as there is no dev supplied. On the other hand, the reason we need rt-> is to get the net. So we can just try get it from skb->dev when rt-> is NULL. v4: Julian Anastasov remind skb->dev also could be NULL. We'd better still use and do a check to avoid crash. v3: No changes. v2: fix the issue in __icmp_send() instead of updating shared dst dev in {ip_md, ip6}_tunnel_xmit. Fixes: c8b34e680a09 ("ip_tunnel: Add tnl_update_pmtu in ip_md_tunnel_xmit") Signed-off-by: Hangbin Liu <> Reviewed-by: Julian Anastasov <> Acked-by: Jonathan Lemon <> Signed-off-by: David S. Miller <>
Diffstat (limited to 'net')
1 files changed, 7 insertions, 1 deletions
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index bf7b5d45de99..4298aae74e0e 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -582,7 +582,13 @@ void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info,
if (!rt)
goto out;
- net = dev_net(rt->;
+ if (rt->
+ net = dev_net(rt->;
+ else if (skb_in->dev)
+ net = dev_net(skb_in->dev);
+ else
+ goto out;
* Find the original header. It is expected to be valid, of course.