* [PATCH] inet: Fix BUG triggered by __rt{,6}_get_peer().
@ 2012-06-11 22:57 David Miller
0 siblings, 0 replies; only message in thread
From: David Miller @ 2012-06-11 22:57 UTC (permalink / raw)
To: netdev
If no peer actually gets attached (either because create is zero or
the peer allocation fails) we'll trigger a BUG because we
unconditionally do an rt{,6}_peer_ptr() afterwards.
Fix this by guarding it with the proper check.
Signed-off-by: David S. Miller <davem@davemloft.net>
---
include/net/ip6_route.h | 2 +-
include/net/route.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index f88a85c..a2cda24 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -61,7 +61,7 @@ static inline struct inet_peer *__rt6_get_peer(struct rt6_info *rt, int create)
return rt6_peer_ptr(rt);
rt6_bind_peer(rt, create);
- return rt6_peer_ptr(rt);
+ return (rt6_has_peer(rt) ? rt6_peer_ptr(rt) : NULL);
}
static inline struct inet_peer *rt6_get_peer(struct rt6_info *rt)
diff --git a/include/net/route.h b/include/net/route.h
index cc693a5..2bfbc93 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -334,7 +334,7 @@ static inline struct inet_peer *__rt_get_peer(struct rtable *rt, __be32 daddr, i
return rt_peer_ptr(rt);
rt_bind_peer(rt, daddr, create);
- return rt_peer_ptr(rt);
+ return (rt_has_peer(rt) ? rt_peer_ptr(rt) : NULL);
}
static inline struct inet_peer *rt_get_peer(struct rtable *rt, __be32 daddr)
--
1.7.10
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2012-06-11 22:57 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-06-11 22:57 [PATCH] inet: Fix BUG triggered by __rt{,6}_get_peer() David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).