ipv6: fix leaking uninitialized port number of offender sockaddr

[firefly-linux-kernel-4.4.55.git] / net / ipv6 / ip6_fib.c

diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 192dd1a0e18810f01923b43ef5f4a75c5b5d8d35..9c06ecb6556e6600162aac78018e3f196295b851 100644 (file)
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -632,6 +632,12 @@ insert_above:
        return ln;
 }
 
+static inline bool rt6_qualify_for_ecmp(struct rt6_info *rt)
+{
+       return (rt->rt6i_flags & (RTF_GATEWAY|RTF_ADDRCONF|RTF_DYNAMIC)) ==
+              RTF_GATEWAY;
+}
+
 /*
  *     Insert routing information in a node.
  */
@@ -646,6 +652,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
        int add = (!info->nlh ||
                   (info->nlh->nlmsg_flags & NLM_F_CREATE));
        int found = 0;
+       bool rt_can_ecmp = rt6_qualify_for_ecmp(rt);
 
        ins = &fn->leaf;
 
@@ -691,9 +698,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
                         * To avoid long list, we only had siblings if the
                         * route have a gateway.
                         */
-                       if (rt->rt6i_flags & RTF_GATEWAY &&
-                           !(rt->rt6i_flags & RTF_EXPIRES) &&
-                           !(iter->rt6i_flags & RTF_EXPIRES))
+                       if (rt_can_ecmp &&
+                           rt6_qualify_for_ecmp(iter))
                                rt->rt6i_nsiblings++;
                }
 
@@ -715,7 +721,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
                /* Find the first route that have the same metric */
                sibling = fn->leaf;
                while (sibling) {
-                       if (sibling->rt6i_metric == rt->rt6i_metric) {
+                       if (sibling->rt6i_metric == rt->rt6i_metric &&
+                           rt6_qualify_for_ecmp(sibling)) {
                                list_add_tail(&rt->rt6i_siblings,
                                              &sibling->rt6i_siblings);
                                break;
@@ -818,9 +825,9 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
        fn = fib6_add_1(root, &rt->rt6i_dst.addr, sizeof(struct in6_addr),
                        rt->rt6i_dst.plen, offsetof(struct rt6_info, rt6i_dst),
                        allow_create, replace_required);
-
        if (IS_ERR(fn)) {
                err = PTR_ERR(fn);
+               fn = NULL;
                goto out;
        }
 
@@ -986,14 +993,22 @@ static struct fib6_node * fib6_lookup_1(struct fib6_node *root,
 
                        if (ipv6_prefix_equal(&key->addr, args->addr, key->plen)) {
 #ifdef CONFIG_IPV6_SUBTREES
-                               if (fn->subtree)
-                                       fn = fib6_lookup_1(fn->subtree, args + 1);
+                               if (fn->subtree) {
+                                       struct fib6_node *sfn;
+                                       sfn = fib6_lookup_1(fn->subtree,
+                                                           args + 1);
+                                       if (!sfn)
+                                               goto backtrack;
+                                       fn = sfn;
+                               }
 #endif
-                               if (!fn || fn->fn_flags & RTN_RTINFO)
+                               if (fn->fn_flags & RTN_RTINFO)
                                        return fn;
                        }
                }
-
+#ifdef CONFIG_IPV6_SUBTREES
+backtrack:
+#endif
                if (fn->fn_flags & RTN_ROOT)
                        break;