summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorDavid S. Miller <davem@davemloft.net>2012-06-11 15:13:57 +0400
committerDavid S. Miller <davem@davemloft.net>2012-06-11 15:13:57 +0400
commit7b34ca2ac7063f4ebf07f85fd75253ed84d5c648 (patch)
tree639e89875cd047bb461ab61348050586ceca56b2 /net
parent8b96d22d7a6ec999ae53ae86d829137503ceda65 (diff)
downloadlinux-7b34ca2ac7063f4ebf07f85fd75253ed84d5c648.tar.xz
inet: Avoid potential NULL peer dereference.
We handle NULL in rt{,6}_set_peer but then our caller will try to pass that NULL pointer into inet_putpeer() which isn't ready for it. Fix this by moving the NULL check one level up, and then remove the now unnecessary NULL check from inetpeer_ptr_set_peer(). Reported-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/ipv4/route.c11
-rw-r--r--net/ipv6/route.c10
2 files changed, 12 insertions, 9 deletions
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 4c33ce3000ed..842510d50453 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1333,11 +1333,12 @@ void rt_bind_peer(struct rtable *rt, __be32 daddr, int create)
return;
peer = inet_getpeer_v4(base, daddr, create);
-
- if (!rt_set_peer(rt, peer))
- inet_putpeer(peer);
- else
- rt->rt_peer_genid = rt_peer_genid();
+ if (peer) {
+ if (!rt_set_peer(rt, peer))
+ inet_putpeer(peer);
+ else
+ rt->rt_peer_genid = rt_peer_genid();
+ }
}
/*
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index d9ba4808f26a..58a3ec23da2f 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -313,10 +313,12 @@ void rt6_bind_peer(struct rt6_info *rt, int create)
return;
peer = inet_getpeer_v6(base, &rt->rt6i_dst.addr, create);
- if (!rt6_set_peer(rt, peer))
- inet_putpeer(peer);
- else
- rt->rt6i_peer_genid = rt6_peer_genid();
+ if (peer) {
+ if (!rt6_set_peer(rt, peer))
+ inet_putpeer(peer);
+ else
+ rt->rt6i_peer_genid = rt6_peer_genid();
+ }
}
static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,