diff options
| author | David S. Miller <davem@davemloft.net> | 2012-06-11 11:13:57 (GMT) |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2012-06-11 11:13:57 (GMT) |
| commit | 7b34ca2ac7063f4ebf07f85fd75253ed84d5c648 (patch) | |
| tree | 639e89875cd047bb461ab61348050586ceca56b2 /net | |
| parent | 8b96d22d7a6ec999ae53ae86d829137503ceda65 (diff) | |
| download | linux-7b34ca2ac7063f4ebf07f85fd75253ed84d5c648.tar.xz | |
inet: Avoid potential NULL peer dereference.
We handle NULL in rt{,6}_set_peer but then our caller will try to pass
that NULL pointer into inet_putpeer() which isn't ready for it.
Fix this by moving the NULL check one level up, and then remove the
now unnecessary NULL check from inetpeer_ptr_set_peer().
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv4/route.c | 11 | ||||
| -rw-r--r-- | net/ipv6/route.c | 10 |
2 files changed, 12 insertions, 9 deletions
diff --git a/net/ipv4/route.c b/net/ipv4/route.c index 4c33ce3..842510d 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -1333,11 +1333,12 @@ void rt_bind_peer(struct rtable *rt, __be32 daddr, int create) return; peer = inet_getpeer_v4(base, daddr, create); - - if (!rt_set_peer(rt, peer)) - inet_putpeer(peer); - else - rt->rt_peer_genid = rt_peer_genid(); + if (peer) { + if (!rt_set_peer(rt, peer)) + inet_putpeer(peer); + else + rt->rt_peer_genid = rt_peer_genid(); + } } /* diff --git a/net/ipv6/route.c b/net/ipv6/route.c index d9ba480..58a3ec2 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -313,10 +313,12 @@ void rt6_bind_peer(struct rt6_info *rt, int create) return; peer = inet_getpeer_v6(base, &rt->rt6i_dst.addr, create); - if (!rt6_set_peer(rt, peer)) - inet_putpeer(peer); - else - rt->rt6i_peer_genid = rt6_peer_genid(); + if (peer) { + if (!rt6_set_peer(rt, peer)) + inet_putpeer(peer); + else + rt->rt6i_peer_genid = rt6_peer_genid(); + } } static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev, |