icmp: Don't leak original dst into ip_route_input()

tgraf · davem330 · commit 773a69d64bf6 · 2015-07-21T10:39:05.000-07:00
ip_route_input() unconditionally overwrites the dst. Hide the original
dst attached to the skb by calling skb_dst_set(skb, NULL) prior to
ip_route_input().

Reported-by: Julian Anastasov &lt;ja@ssi.bg&gt;
Signed-off-by: Thomas Graf &lt;tgraf@suug.ch&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
@@ -496,6 +496,7 @@ static struct rtable *icmp_route_lookup(struct net *net,
 		}
 		/* Ugh! */
 		orefdst = skb_in->_skb_refdst; /* save old refdst */
+		skb_dst_set(skb_in, NULL);
 		err = ip_route_input(skb_in, fl4_dec.daddr, fl4_dec.saddr,
 				     RT_TOS(tos), rt2->dst.dev);
 

Original file line number	Diff line number	Diff line change
`@@ -496,6 +496,7 @@ static struct rtable icmp_route_lookup(struct net net,`
`496`	`496`	`}`
`497`	`497`	`/* Ugh! */`
`498`	`498`	`orefdst = skb_in->_skb_refdst; /* save old refdst */`
	`499`	`+ skb_dst_set(skb_in, NULL);`
`499`	`500`	`err = ip_route_input(skb_in, fl4_dec.daddr, fl4_dec.saddr,`
`500`	`501`	`RT_TOS(tos), rt2->dst.dev);`
`501`	`502`