提交 4cfc86f3 编写于 作者: L Lance Richardson 提交者: David S. Miller

ipv4: initialize flowi4_flags before calling fib_lookup()

Field fl4.flowi4_flags is not initialized in fib_compute_spec_dst()
before calling fib_lookup(), which means fib_table_lookup() is
using non-deterministic data at this line:

	if (!(flp->flowi4_flags & FLOWI_FLAG_SKIP_NH_OIF)) {

Fix by initializing the entire fl4 structure, which will prevent
similar issues as fields are added in the future by ensuring that
all fields are initialized to zero unless explicitly initialized
to another value.

Fixes: 58189ca7 ("net: Fix vti use case with oif in dst lookups")
Suggested-by: NDavid Ahern <dsa@cumulusnetworks.com>
Signed-off-by: NLance Richardson <lrichard@redhat.com>
Acked-by: NDavid Ahern <dsa@cumulusnetworks.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 6e9bdc72
...@@ -280,7 +280,6 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb) ...@@ -280,7 +280,6 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
struct in_device *in_dev; struct in_device *in_dev;
struct fib_result res; struct fib_result res;
struct rtable *rt; struct rtable *rt;
struct flowi4 fl4;
struct net *net; struct net *net;
int scope; int scope;
...@@ -296,14 +295,13 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb) ...@@ -296,14 +295,13 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
scope = RT_SCOPE_UNIVERSE; scope = RT_SCOPE_UNIVERSE;
if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) { if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) {
fl4.flowi4_oif = 0; struct flowi4 fl4 = {
fl4.flowi4_iif = LOOPBACK_IFINDEX; .flowi4_iif = LOOPBACK_IFINDEX,
fl4.daddr = ip_hdr(skb)->saddr; .daddr = ip_hdr(skb)->saddr,
fl4.saddr = 0; .flowi4_tos = RT_TOS(ip_hdr(skb)->tos),
fl4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos); .flowi4_scope = scope,
fl4.flowi4_scope = scope; .flowi4_mark = IN_DEV_SRC_VMARK(in_dev) ? skb->mark : 0,
fl4.flowi4_mark = IN_DEV_SRC_VMARK(in_dev) ? skb->mark : 0; };
fl4.flowi4_tun_key.tun_id = 0;
if (!fib_lookup(net, &fl4, &res, 0)) if (!fib_lookup(net, &fl4, &res, 0))
return FIB_RES_PREFSRC(net, res); return FIB_RES_PREFSRC(net, res);
} else { } else {
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册