2 files changed, 6 insertions, 0 deletions

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 0302e0eb07af..7178e32eb15d 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2330,6 +2330,10 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
 
                 rcu_read_lock();
                 from = rcu_dereference(rt6->from);
+                if (!from) {
+                        rcu_read_unlock();
+                        return;
+                }
                 nrt6 = ip6_rt_cache_alloc(from, daddr, saddr);
                 if (nrt6) {
                         rt6_do_update_pmtu(nrt6, mtu);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index b444483cdb2b..622eeaf5732b 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1047,6 +1047,8 @@ static void udp_v6_flush_pending_frames(struct sock *sk)
 static int udpv6_pre_connect(struct sock *sk, struct sockaddr *uaddr,
                              int addr_len)
 {
+        if (addr_len < offsetofend(struct sockaddr, sa_family))
+                return -EINVAL;
         /* The following checks are replicated from __ip6_datagram_connect()
          * and intended to prevent BPF program called below from accessing
          * bytes that are out of the bound specified by user in addr_len.