DORMANTno replies

[PATCH] inet: Fix BUG triggered by __rt{,6}_get_peer().

From: David Miller <davem@davemloft.net>
Date: 2012-06-11 22:57:25
Subsystem: networking [general], networking [ipv4/ipv6], the rest · Maintainers: "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, David Ahern, Ido Schimmel, Linus Torvalds

If no peer actually gets attached (either because create is zero or
the peer allocation fails) we'll trigger a BUG because we
unconditionally do an rt{,6}_peer_ptr() afterwards.

Fix this by guarding it with the proper check.

Signed-off-by: David S. Miller <davem@davemloft.net>
---
 include/net/ip6_route.h |    2 +-
 include/net/route.h     |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index f88a85c..a2cda24 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -61,7 +61,7 @@ static inline struct inet_peer *__rt6_get_peer(struct rt6_info *rt, int create)
 		return rt6_peer_ptr(rt);
 
 	rt6_bind_peer(rt, create);
-	return rt6_peer_ptr(rt);
+	return (rt6_has_peer(rt) ? rt6_peer_ptr(rt) : NULL);
 }
 
 static inline struct inet_peer *rt6_get_peer(struct rt6_info *rt)
diff --git a/include/net/route.h b/include/net/route.h
index cc693a5..2bfbc93 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -334,7 +334,7 @@ static inline struct inet_peer *__rt_get_peer(struct rtable *rt, __be32 daddr, i
 		return rt_peer_ptr(rt);
 
 	rt_bind_peer(rt, daddr, create);
-	return rt_peer_ptr(rt);
+	return (rt_has_peer(rt) ? rt_peer_ptr(rt) : NULL);
 }
 
 static inline struct inet_peer *rt_get_peer(struct rtable *rt, __be32 daddr)
-- 
1.7.10
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help