Skip to content

Commit f707ef6

Browse files
qsndavem330
authored andcommitted
net: rtnl: return early from rtnl_unregister_all when protocol isn't registered
rtnl_unregister_all(PF_INET6) gets called from inet6_init in cases when no handler has been registered for PF_INET6 yet, for example if ip6_mr_init() fails. Abort and avoid a NULL pointer deref in that case. Example of panic (triggered by faking a failure of register_pernet_subsys): general protection fault: 0000 [#1] PREEMPT SMP KASAN PTI [...] RIP: 0010:rtnl_unregister_all+0x17e/0x2a0 [...] Call Trace: ? rtnetlink_net_init+0x250/0x250 ? sock_unregister+0x103/0x160 ? kernel_getsockopt+0x200/0x200 inet6_init+0x197/0x20d Fixes: e2fddf5 ("[IPV6]: Make af_inet6 to check ip6_route_init return value.") Signed-off-by: Sabrina Dubroca <[email protected]> Signed-off-by: David S. Miller <[email protected]>
1 parent a03dc36 commit f707ef6

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

net/core/rtnetlink.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -324,6 +324,10 @@ void rtnl_unregister_all(int protocol)
324324

325325
rtnl_lock();
326326
tab = rtnl_msg_handlers[protocol];
327+
if (!tab) {
328+
rtnl_unlock();
329+
return;
330+
}
327331
RCU_INIT_POINTER(rtnl_msg_handlers[protocol], NULL);
328332
for (msgindex = 0; msgindex < RTM_NR_MSGTYPES; msgindex++) {
329333
link = tab[msgindex];

0 commit comments

Comments
 (0)