Commit e3fa461d authored by Nicolas Dichtel's avatar Nicolas Dichtel Committed by David S. Miller
Browse files

ipv6: fix panic when forwarding a pkt with no in6 dev 



kongweibin reported a kernel panic in ip6_forward() when input interface
has no in6 dev associated.

The following tc commands were used to reproduce this panic:
tc qdisc del dev vxlan100 root
tc qdisc add dev vxlan100 root netem corrupt 5%

CC: stable@vger.kernel.org
Fixes: ccd27f05 ("ipv6: fix 'disable_policy' for fwd packets")
Reported-by: default avatarkongweibin <kongweibin2@huawei.com>
Signed-off-by: default avatarNicolas Dichtel <nicolas.dichtel@6wind.com>
Reviewed-by: default avatarDavid Ahern <dsahern@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1a7eb80d

net/ipv6/ip6_output.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -485,7 +485,7 @@ int ip6_forward(struct sk_buff *skb) 
		goto drop;

		goto drop;





	if (!net->ipv6.devconf_all->disable_policy &&

	if (!net->ipv6.devconf_all->disable_policy &&

	    !idev->cnf.disable_policy &&

	    (!idev || !idev->cnf.disable_policy) &&

	    !xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {

	    !xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {

		__IP6_INC_STATS(net, idev, IPSTATS_MIB_INDISCARDS);

		__IP6_INC_STATS(net, idev, IPSTATS_MIB_INDISCARDS);

		goto drop;

		goto drop;