Re: [Patch net-next] ipv6: fix a potential NULL deref

On Mon, 2012-10-29 at 08:05 +0100, Eric Dumazet wrote:

On Mon, 2012-10-29 at 14:49 +0800, Cong Wang wrote:

quoted

On Mon, 2012-10-29 at 07:10 +0100, Eric Dumazet wrote:

quoted

quoted

-		dst_release(&rt->dst);
+		if (rt)
+			dst_release(&rt->dst);
 	}
 

dst_release() is like kfree(), it accepts a NULL argument.

'rt->dst' already dereferences 'rt', no matter dst_release() accepts
NULL or not.

&rt->dst doesnt dereference rt, you are quite mistaken.

if rt is NULL, &rt->dst is also NULL

Oh, yeah, gcc should be smart enough to do calculation without deref it
given it has the offset and the address. And dst happens to be first
field of rt, so offset is 0, &rt->dst should be NULL too if rt is NULL.

But this will be a problem if someone moved dst inside rt, as there is
no comment saying dst has to be the first one?