1 files changed, 10 insertions, 7 deletions

diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 54596f73eff5..d0a6092a67be 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -802,6 +802,9 @@ static int ipmr_mfc_add(struct net *net, struct mfcctl *mfc, int mrtsock)
         int line;
         struct mfc_cache *uc, *c, **cp;
 
+        if (mfc->mfcc_parent >= MAXVIFS)
+                return -ENFILE;
+
         line = MFC_HASH(mfc->mfcc_mcastgrp.s_addr, mfc->mfcc_origin.s_addr);
 
         for (cp = &net->ipv4.mfc_cache_array[line];
@@ -1163,9 +1166,6 @@ static int ipmr_device_event(struct notifier_block *this, unsigned long event, v
         int ct;
         LIST_HEAD(list);
 
-        if (!net_eq(dev_net(dev), net))
-                return NOTIFY_DONE;
-
         if (event != NETDEV_UNREGISTER)
                 return NOTIFY_DONE;
         v = &net->ipv4.vif_table[0];
@@ -1616,17 +1616,20 @@ ipmr_fill_mroute(struct sk_buff *skb, struct mfc_cache *c, struct rtmsg *rtm)
         int ct;
         struct rtnexthop *nhp;
         struct net *net = mfc_net(c);
-        struct net_device *dev = net->ipv4.vif_table[c->mfc_parent].dev;
         u8 *b = skb_tail_pointer(skb);
         struct rtattr *mp_head;
 
-        if (dev)
-                RTA_PUT(skb, RTA_IIF, 4, &dev->ifindex);
+        /* If cache is unresolved, don't try to parse IIF and OIF */
+        if (c->mfc_parent > MAXVIFS)
+                return -ENOENT;
+
+        if (VIF_EXISTS(net, c->mfc_parent))
+                RTA_PUT(skb, RTA_IIF, 4, &net->ipv4.vif_table[c->mfc_parent].dev->ifindex);
 
         mp_head = (struct rtattr *)skb_put(skb, RTA_LENGTH(0));
 
         for (ct = c->mfc_un.res.minvif; ct < c->mfc_un.res.maxvif; ct++) {
-                if (c->mfc_un.res.ttls[ct] < 255) {
+                if (VIF_EXISTS(net, ct) && c->mfc_un.res.ttls[ct] < 255) {
                         if (skb_tailroom(skb) < RTA_ALIGN(RTA_ALIGN(sizeof(*nhp)) + 4))
                                 goto rtattr_failure;
                         nhp = (struct rtnexthop *)skb_put(skb, RTA_ALIGN(sizeof(*nhp)));