From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934001AbcKMNbO (ORCPT ); Sun, 13 Nov 2016 08:31:14 -0500 Received: from frisell.zx2c4.com ([192.95.5.64]:39924 "EHLO frisell.zx2c4.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933505AbcKMNbN (ORCPT ); Sun, 13 Nov 2016 08:31:13 -0500 From: "Jason A. Donenfeld" To: David Ahern , Netdev , WireGuard mailing list , LKML , YOSHIFUJI Hideaki , Hannes Frederic Sowa Cc: "Jason A. Donenfeld" Subject: [PATCH] ip6_output: ensure flow saddr actually belongs to device Date: Sun, 13 Nov 2016 14:23:47 +0100 Message-Id: <20161113132347.17907-1-Jason@zx2c4.com> X-Mailer: git-send-email 2.10.2 In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This puts the IPv6 routing functions in parity with the IPv4 routing functions. Namely, we now check in v6 that if a flowi6 requests an saddr, the returned dst actually corresponds to a net device that has that saddr. This mirrors the v4 logic with __ip_dev_find in __ip_route_output_key_hash. In the event that the returned dst is not for a dst with a dev that has the saddr, we return -EINVAL, just like v4; this makes it easy to use the same error handlers for both cases. Signed-off-by: Jason A. Donenfeld Cc: David Ahern --- net/ipv6/ip6_output.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 6001e78..a834129 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1011,6 +1011,11 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk, } } #endif + if (!ipv6_addr_any(&fl6->saddr) && + !ipv6_chk_addr(net, &fl6->saddr, (*dst)->dev, 1)) { + err = -EINVAL; + goto out_err_release; + } return 0; -- 2.10.2