releases/5.0.3/ipv4-route-fail-early-when-inet-dev-is-missing.patch

   1 From foo@baz Thu Mar 14 23:19:55 PDT 2019
   2 From: Paolo Abeni <pabeni@redhat.com>
   3 Date: Wed, 6 Mar 2019 10:42:53 +0100
   4 Subject: ipv4/route: fail early when inet dev is missing
   5
   6 From: Paolo Abeni <pabeni@redhat.com>
   7
   8 [ Upstream commit 22c74764aa2943ecdf9f07c900d8a9c8ba6c9265 ]
   9
  10 If a non local multicast packet reaches ip_route_input_rcu() while
  11 the ingress device IPv4 private data (in_dev) is NULL, we end up
  12 doing a NULL pointer dereference in IN_DEV_MFORWARD().
  13
  14 Since the later call to ip_route_input_mc() is going to fail if
  15 !in_dev, we can fail early in such scenario and avoid the dangerous
  16 code path.
  17
  18 v1 -> v2:
  19  - clarified the commit message, no code changes
  20
  21 Reported-by: Tianhao Zhao <tizhao@redhat.com>
  22 Fixes: e58e41596811 ("net: Enable support for VRF with ipv4 multicast")
  23 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  24 Reviewed-by: David Ahern <dsahern@gmail.com>
  25 Signed-off-by: David S. Miller <davem@davemloft.net>
  26 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  27 ---
  28  net/ipv4/route.c |    9 +++++----
  29  1 file changed, 5 insertions(+), 4 deletions(-)
  30
  31 --- a/net/ipv4/route.c
  32 +++ b/net/ipv4/route.c
  33 @@ -2144,12 +2144,13 @@ int ip_route_input_rcu(struct sk_buff *s
  34                 int our = 0;
  35                 int err = -EINVAL;
  36
  37 -               if (in_dev)
  38 -                       our = ip_check_mc_rcu(in_dev, daddr, saddr,
  39 -                                             ip_hdr(skb)->protocol);
  40 +               if (!in_dev)
  41 +                       return err;
  42 +               our = ip_check_mc_rcu(in_dev, daddr, saddr,
  43 +                                     ip_hdr(skb)->protocol);
  44
  45                 /* check l3 master if no match yet */
  46 -               if ((!in_dev || !our) && netif_is_l3_slave(dev)) {
  47 +               if (!our && netif_is_l3_slave(dev)) {
  48                         struct in_device *l3_in_dev;
  49
  50                         l3_in_dev = __in_dev_get_rcu(skb->dev);