diff options
| author | David S. Miller <davem@davemloft.net> | 2019-04-17 11:26:25 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-04-17 11:26:25 -0700 |
| commit | 6b0a7f84ea1fe248df96ccc4dd86e817e32ef65b (patch) | |
| tree | 0a7976054052e793da782c2b7ec34eccfbf66449 /net/ipv6 | |
| parent | cea0aa9cbd5ad4efe267e9487ed5d48d16756253 (diff) | |
| parent | fe5cdef29e41c8bda8cd1a11545e7c6bfe25570e (diff) | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Conflict resolution of af_smc.c from Stephen Rothwell.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6')
| -rw-r--r-- | net/ipv6/route.c | 4 | ||||
| -rw-r--r-- | net/ipv6/udp.c | 2 |
2 files changed, 6 insertions, 0 deletions
diff --git a/net/ipv6/route.c b/net/ipv6/route.c index a77c004d67fb..9ece8067a59b 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -2331,6 +2331,10 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk, rcu_read_lock(); from = rcu_dereference(rt6->from); + if (!from) { + rcu_read_unlock(); + return; + } nrt6 = ip6_rt_cache_alloc(from, daddr, saddr); if (nrt6) { rt6_do_update_pmtu(nrt6, mtu); diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index d538fafaf4a9..2464fba569b4 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -1045,6 +1045,8 @@ static void udp_v6_flush_pending_frames(struct sock *sk) static int udpv6_pre_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) { + if (addr_len < offsetofend(struct sockaddr, sa_family)) + return -EINVAL; /* The following checks are replicated from __ip6_datagram_connect() * and intended to prevent BPF program called below from accessing * bytes that are out of the bound specified by user in addr_len. |