Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 24b43c99 authored by Paolo Abeni's avatar Paolo Abeni Committed by Doug Ledford
Browse files

infiniband: avoid dereferencing uninitialized dst on error path 



With commit eea40b8f ("infiniband: call ipv6 route lookup
via the stub interface"), if the route lookup fails due to
ipv6 being disabled, the dst variable is left untouched, and
the following dst_release() may access uninitialized memory.

Since ipv6_dst_lookup() always sets dst to NULL in case of
lookup failure with ipv6 enabled, fix the above just
returning the error code if the lookup fails.

Fixes: eea40b8f ("infiniband: call ipv6 route lookup via the stub interface")
Reported-by: default avatarSabrina Dubroca <sd@queasysnail.net>
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
Reviewed-by: default avatarSabrina Dubroca <sd@queasysnail.net>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent 87f0faad

drivers/infiniband/core/addr.c

+1 −1
Original line number Diff line number Diff line
@@ -446,7 +446,7 @@ static int addr6_resolve(struct sockaddr_in6 *src_in, 


	ret = ipv6_stub->ipv6_dst_lookup(addr->net, NULL, &dst, &fl6);

	if (ret < 0)

		goto put;

		return ret;



	rt = (struct rt6_info *)dst;

	if (ipv6_addr_any(&fl6.saddr)) {