Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7b34ca2a authored by David S. Miller's avatar David S. Miller
Browse files

inet: Avoid potential NULL peer dereference. 



We handle NULL in rt{,6}_set_peer but then our caller will try to pass
that NULL pointer into inet_putpeer() which isn't ready for it.

Fix this by moving the NULL check one level up, and then remove the
now unnecessary NULL check from inetpeer_ptr_set_peer().

Reported-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8b96d22d

include/net/inetpeer.h

+1 −1
Original line number Diff line number Diff line
@@ -104,7 +104,7 @@ static inline bool inetpeer_ptr_set_peer(unsigned long *ptr, struct inet_peer *p 
	unsigned long val = (unsigned long) peer;

	unsigned long orig = *ptr;



	if (!(orig & INETPEER_BASE_BIT) || !val ||

	if (!(orig & INETPEER_BASE_BIT) ||

	    cmpxchg(ptr, orig, val) != orig)

		return false;

	return true;

net/ipv4/route.c

+6 −5
Original line number Diff line number Diff line
@@ -1333,12 +1333,13 @@ void rt_bind_peer(struct rtable *rt, __be32 daddr, int create) 
		return;



	peer = inet_getpeer_v4(base, daddr, create);



	if (peer) {

		if (!rt_set_peer(rt, peer))

			inet_putpeer(peer);

		else

			rt->rt_peer_genid = rt_peer_genid();

	}

}



/*

 * Peer allocation may fail only in serious out-of-memory conditions.  However

net/ipv6/route.c

+6 −4
Original line number Diff line number Diff line
@@ -313,11 +313,13 @@ void rt6_bind_peer(struct rt6_info *rt, int create) 
		return;



	peer = inet_getpeer_v6(base, &rt->rt6i_dst.addr, create);

	if (peer) {

		if (!rt6_set_peer(rt, peer))

			inet_putpeer(peer);

		else

			rt->rt6i_peer_genid = rt6_peer_genid();

	}

}



static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,

			   int how)