summaryrefslogtreecommitdiff
path: root/include
diff options
context:
space:
mode:
authorJason Wang <jasowang@redhat.com>2011-10-09 10:56:44 +0800
committerGreg Kroah-Hartman <gregkh@suse.de>2011-10-16 14:14:54 -0700
commita1b7ab0836a56fa4c9578f88ba1042398d7d9316 (patch)
tree5b5435397e994519b529c143c6960a35eb015308 /include
parent00b8e8ceece20db990b1fbb11f1d6051a276436b (diff)
ipv6: fix NULL dereference in udp6_ufo_fragment()
This patch fixes the issue caused by ef81bb40bf15f350fe865f31fa42f1082772a576 which is a backport of upstream 87c48fa3b4630905f98268dde838ee43626a060c. The problem does not exist in upstream. We do not check whether route is attached before trying to assign ip identification through route dest which lead NULL pointer dereference. This happens when host bridge transmit a packet from guest. This patch changes ipv6_select_ident() to accept in6_addr as its paramter and fix the issue by using the destination address in ipv6 header when no route is attached. Signed-off-by: Jason Wang <jasowang@redhat.com> Acked-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'include')
-rw-r--r--include/net/ipv6.h2
1 files changed, 1 insertions, 1 deletions
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 3b5ac1fbff39..c39121f6bc94 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -463,7 +463,7 @@ static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_add
return __ipv6_addr_diff(a1, a2, sizeof(struct in6_addr));
}
-extern void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt);
+extern void ipv6_select_ident(struct frag_hdr *fhdr, struct in6_addr *addr);
/*
* Prototypes exported by ipv6