[IPV6]: Fix crash in ip6_del_rt
authorPatrick McHardy <kaber@trash.net>
Mon, 7 Aug 2006 05:22:47 +0000 (22:22 -0700)
committerDavid S. Miller <davem@sunset.davemloft.net>
Fri, 22 Sep 2006 21:53:57 +0000 (14:53 -0700)
ip6_null_entry doesn't have rt6i_table set, when trying to delete it the
kernel crashes dereferencing table->tb6_lock.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv6/route.c

index ff5affe2636cce05eb2a2b38bd44d9cbdb2333ec..41c5905d319134b3ca266ac8b29f9c7ce6f977b3 100644 (file)
@@ -1223,6 +1223,9 @@ int ip6_del_rt(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr, struct
        int err;
        struct fib6_table *table;
 
+       if (rt == &ip6_null_entry)
+               return -ENOENT;
+
        table = rt->rt6i_table;
        write_lock_bh(&table->tb6_lock);