func: int CVE_2006_1525_VULN_inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void *arg) struct rtattr * * rta = arg ; struct sk_buff * skb ; skb = alloc_skb ( NLMSG_GOODSIZE , GFP_KERNEL ); if ( ! skb )  if ( rta [ RTA_IIF - 1 ] )  memcpy ( & iif , RTA_DATA ( rta [ RTA_IIF - 1 ] ) , sizeof ( int ) ); if ( iif )  struct net_device * dev = __dev_get_by_index ( iif ) ; if ( ! dev )  skb -> dev = dev; err = ip_route_input ( skb , dst , src , rtm -> rtm_tos , dev ); rt = ( struct rtable * ) skb -> dst; if ( ! err && rt -> u . dst . error )  err = - rt -> u . dst . error; err = ip_route_output_key ( & rt , & fl ); if ( err )  skb -> dst = & rt -> u . dst; rt -> rt_flags |= RTCF_NOTIFY; NETLINK_CB ( skb ) . dst_pid = NETLINK_CB ( in_skb ) . pid; err = rt_fill_info ( skb , NETLINK_CB ( in_skb ) . pid , nlh -> nlmsg_seq , RTM_NEWROUTE , 0 , 0 ); if ( ! err )  if ( err < 0 )  err = netlink_unicast ( rtnl , skb , NETLINK_CB ( in_skb ) . pid , MSG_DONTWAIT ); if ( err > 0 )  return err ; kfree_skb ( skb ); 