Commit 773a69d6 authored by Thomas Graf's avatar Thomas Graf Committed by David S. Miller

icmp: Don't leak original dst into ip_route_input()

ip_route_input() unconditionally overwrites the dst. Hide the original
dst attached to the skb by calling skb_dst_set(skb, NULL) prior to
ip_route_input().
Reported-by: default avatarJulian Anastasov <ja@ssi.bg>
Signed-off-by: default avatarThomas Graf <tgraf@suug.ch>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1d8fff90
...@@ -496,6 +496,7 @@ static struct rtable *icmp_route_lookup(struct net *net, ...@@ -496,6 +496,7 @@ static struct rtable *icmp_route_lookup(struct net *net,
} }
/* Ugh! */ /* Ugh! */
orefdst = skb_in->_skb_refdst; /* save old refdst */ orefdst = skb_in->_skb_refdst; /* save old refdst */
skb_dst_set(skb_in, NULL);
err = ip_route_input(skb_in, fl4_dec.daddr, fl4_dec.saddr, err = ip_route_input(skb_in, fl4_dec.daddr, fl4_dec.saddr,
RT_TOS(tos), rt2->dst.dev); RT_TOS(tos), rt2->dst.dev);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment