From: Thomas Graf <tgraf@suug.ch>
Date: Tue, 21 Jul 2015 08:43:55 +0000 (+0200)
Subject: icmp: Don't leak original dst into ip_route_input()
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=773a69d64bf65eb6c212c97e9737963a2cf668fd;p=linux-beck.git

icmp: Don't leak original dst into ip_route_input()

ip_route_input() unconditionally overwrites the dst. Hide the original
dst attached to the skb by calling skb_dst_set(skb, NULL) prior to
ip_route_input().

Reported-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index f5203fba6236..c0556f1e4bf0 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -496,6 +496,7 @@ static struct rtable *icmp_route_lookup(struct net *net,
 		}
 		/* Ugh! */
 		orefdst = skb_in->_skb_refdst; /* save old refdst */
+		skb_dst_set(skb_in, NULL);
 		err = ip_route_input(skb_in, fl4_dec.daddr, fl4_dec.saddr,
 				     RT_TOS(tos), rt2->dst.dev);