[PATCH] ip6_output: ensure flow saddr actually belongs to device

From: Jason A. Donenfeld
Date: Sun Nov 13 2016 - 08:31:29 EST


This puts the IPv6 routing functions in parity with the IPv4 routing
functions. Namely, we now check in v6 that if a flowi6 requests an
saddr, the returned dst actually corresponds to a net device that has
that saddr. This mirrors the v4 logic with __ip_dev_find in
__ip_route_output_key_hash. In the event that the returned dst is not
for a dst with a dev that has the saddr, we return -EINVAL, just like
v4; this makes it easy to use the same error handlers for both cases.

Signed-off-by: Jason A. Donenfeld <Jason@xxxxxxxxx>
Cc: David Ahern <dsa@xxxxxxxxxxxxxxxxxxx>
---
net/ipv6/ip6_output.c | 5 +++++
1 file changed, 5 insertions(+)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 6001e78..a834129 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1011,6 +1011,11 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk,
}
}
#endif
+ if (!ipv6_addr_any(&fl6->saddr) &&
+ !ipv6_chk_addr(net, &fl6->saddr, (*dst)->dev, 1)) {
+ err = -EINVAL;
+ goto out_err_release;
+ }

return 0;

--
2.10.2