Merge tag 'ipvs-fixes-for-v4.11' of http://git.kernel.org/pub/scm/linux/kernel/git/horms/ipvs

Simon Horman says:

====================
IPVS Fixes for v4.11

I would also like it considered for stable.

* Explicitly forbid ipv6 service/dest creation if ipv6 mod is disabled
  to avoid oops caused by IPVS accesing IPv6 routing code in such
  circumstances.
====================

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 17 insertions, 5 deletions

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 5aeb0dde6ccc..4d753beaac32 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3078,6 +3078,17 @@ nla_put_failure:
         return skb->len;
 }
 
+static bool ip_vs_is_af_valid(int af)
+{
+        if (af == AF_INET)
+                return true;
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6 && ipv6_mod_enabled())
+                return true;
+#endif
+        return false;
+}
+
 static int ip_vs_genl_parse_service(struct netns_ipvs *ipvs,
                                     struct ip_vs_service_user_kern *usvc,
                                     struct nlattr *nla, int full_entry,
@@ -3104,11 +3115,7 @@ static int ip_vs_genl_parse_service(struct netns_ipvs *ipvs,
         memset(usvc, 0, sizeof(*usvc));
 
         usvc->af = nla_get_u16(nla_af);
-#ifdef CONFIG_IP_VS_IPV6
-        if (usvc->af != AF_INET && usvc->af != AF_INET6)
-#else
-        if (usvc->af != AF_INET)
-#endif
+        if (!ip_vs_is_af_valid(usvc->af))
                 return -EAFNOSUPPORT;
 
         if (nla_fwmark) {
@@ -3610,6 +3617,11 @@ static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
                 if (udest.af == 0)
                         udest.af = svc->af;
 
+                if (!ip_vs_is_af_valid(udest.af)) {
+                        ret = -EAFNOSUPPORT;
+                        goto out;
+                }
+
                 if (udest.af != svc->af && cmd != IPVS_CMD_DEL_DEST) {
                         /* The synchronization protocol is incompatible
                          * with mixed family services