inet: Avoid potential NULL peer dereference.

We handle NULL in rt{,6}_set_peer but then our caller will try to pass
that NULL pointer into inet_putpeer() which isn't ready for it.

Fix this by moving the NULL check one level up, and then remove the
now unnecessary NULL check from inetpeer_ptr_set_peer().

Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index e15c0862a686129c00cb061f351b3ba240eb85b6..c27c8f10ebdc4db86e35a19582894a056615a067 100644 (file)
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -104,7 +104,7 @@ static inline bool inetpeer_ptr_set_peer(unsigned long *ptr, struct inet_peer *p
        unsigned long val = (unsigned long) peer;
        unsigned long orig = *ptr;
 
-       if (!(orig & INETPEER_BASE_BIT) || !val ||
+       if (!(orig & INETPEER_BASE_BIT) ||
            cmpxchg(ptr, orig, val) != orig)
                return false;
        return true;

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 4c33ce3000edcef32dfcfe584aac52fbbe2e29a5..842510d50453409482b03a4964022b8f4a501eb0 100644 (file)
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1333,11 +1333,12 @@ void rt_bind_peer(struct rtable *rt, __be32 daddr, int create)
                return;
 
        peer = inet_getpeer_v4(base, daddr, create);
-
-       if (!rt_set_peer(rt, peer))
-               inet_putpeer(peer);
-       else
-               rt->rt_peer_genid = rt_peer_genid();
+       if (peer) {
+               if (!rt_set_peer(rt, peer))
+                       inet_putpeer(peer);
+               else
+                       rt->rt_peer_genid = rt_peer_genid();
+       }
 }
 
 /*

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index d9ba4808f26acba253f07e766bde3d3b17a34997..58a3ec23da2f7fbb45eb3306e2cbb8187267f203 100644 (file)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -313,10 +313,12 @@ void rt6_bind_peer(struct rt6_info *rt, int create)
                return;
 
        peer = inet_getpeer_v6(base, &rt->rt6i_dst.addr, create);
-       if (!rt6_set_peer(rt, peer))
-               inet_putpeer(peer);
-       else
-               rt->rt6i_peer_genid = rt6_peer_genid();
+       if (peer) {
+               if (!rt6_set_peer(rt, peer))
+                       inet_putpeer(peer);
+               else
+                       rt->rt6i_peer_genid = rt6_peer_genid();
+       }
 }
 
 static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,