Commit f63ce5b6 authored Nov 04, 2015 by Tobias Klauser Committed by David S. Miller Nov 04, 2015

tun_dst: Fix potential NULL dereference



In tun_dst_unclone() the return value of skb_metadata_dst() is checked
for being NULL after it is dereferenced. Fix this by moving the
dereference after the NULL check.

Found by the Coverity scanner (CID 1338068).

Fixes: fc4099f1 ("openvswitch: Fix egress tunnel info.")
Cc: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent e7868a85

include/net/dst_metadata.h

+2 −1

Original line number	Diff line number	Diff line
		@@ -63,12 +63,13 @@ static inline struct metadata_dst *tun_rx_dst(int md_size)
		static inline struct metadata_dst tun_dst_unclone(struct sk_buff skb)
		{
		struct metadata_dst *md_dst = skb_metadata_dst(skb);
		int md_size = md_dst->u.tun_info.options_len;
		int md_size;
		struct metadata_dst *new_md;

		if (!md_dst)
		return ERR_PTR(-EINVAL);

		md_size = md_dst->u.tun_info.options_len;
		new_md = metadata_dst_alloc(md_size, GFP_ATOMIC);
		if (!new_md)
		return ERR_PTR(-ENOMEM);