On 3/5/19 5:49 AM, Paolo Abeni wrote:
> If a non local multicast packet reaches ip_route_input_rcu() while
> the ingress device is NULL, we end up doing a NULL pointer
A clarification: the ingress device is not NULL; it's the IPv4 private
data (in_device).
> dereference in IN_DEV_MFORWARD().
>
> Since the later call to ip_route_input_mc() is going to fail if
> !in_dev, we can fail early in such scenario and avoid the dangerous
> code path.
>
> Reported-by: Tianhao Zhao <tiz...@redhat.com>
> Fixes: e58e41596811 ("net: Enable support for VRF with ipv4 multicast")
> Signed-off-by: Paolo Abeni <pab...@redhat.com>
> ---
> net/ipv4/route.c | 9 +++++----
> 1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/net/ipv4/route.c b/net/ipv4/route.c
> index 7bb9128c8363..e40e56e014a0 100644
> --- a/net/ipv4/route.c
> +++ b/net/ipv4/route.c
> @@ -2144,12 +2144,13 @@ int ip_route_input_rcu(struct sk_buff *skb, __be32
> daddr, __be32 saddr,
> int our = 0;
> int err = -EINVAL;
>
> - if (in_dev)
> - our = ip_check_mc_rcu(in_dev, daddr, saddr,
> - ip_hdr(skb)->protocol);
> + if (!in_dev)
> + return err;
The point of e58e41596811 was to allow multicast address on the VRF
device for Rx (I believe Allied Tellesis relies on that). I think the
logic needs another tweak to properly handle that case and account for
no ipv4 struct on the ingress device. I will have to come back to it
when I have time to setup a test case. For now, tracing ip_check_mc_rcu
to ip_mc_validate_source, you are correct. We can bail here if in_dev is
NULL on the real ingress device.
Reviewed-by: David Ahern <dsah...@gmail.com>
> + our = ip_check_mc_rcu(in_dev, daddr, saddr,
> + ip_hdr(skb)->protocol);
>
> /* check l3 master if no match yet */
> - if ((!in_dev || !our) && netif_is_l3_slave(dev)) {
> + if (!our && netif_is_l3_slave(dev)) {
> struct in_device *l3_in_dev;
>
> l3_in_dev = __in_dev_get_rcu(skb->dev);
>
