iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

inet: Avoid potential NULL peer dereference.

Browse Source 
We handle NULL in rt{,6}_set_peer but then our caller will try to pass
that NULL pointer into inet_putpeer() which isn't ready for it.

Fix this by moving the NULL check one level up, and then remove the
now unnecessary NULL check from inetpeer_ptr_set_peer().

Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2012-06-11 04:13:57 -07:00
parent 8b96d22d7a
commit 7b34ca2ac7
3 changed files with 13 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/net/inetpeer.h
View File

@ -104,7 +104,7 @@ static inline bool inetpeer_ptr_set_peer(unsigned long *ptr, struct inet_peer *p
unsigned long val = (unsigned long) peer;
unsigned long orig = *ptr;
if (!(orig & INETPEER_BASE_BIT) || !val ||
if (!(orig & INETPEER_BASE_BIT) ||
cmpxchg(ptr, orig, val) != orig)
return false;
return true;

11
net/ipv4/route.c
View File

@ -1333,11 +1333,12 @@ void rt_bind_peer(struct rtable *rt, __be32 daddr, int create)
return;
peer = inet_getpeer_v4(base, daddr, create);
if (!rt_set_peer(rt, peer))
inet_putpeer(peer);
else
rt->rt_peer_genid = rt_peer_genid();
if (peer) {
if (!rt_set_peer(rt, peer))
inet_putpeer(peer);
else
rt->rt_peer_genid = rt_peer_genid();
}
}
/*

10
net/ipv6/route.c
View File

@ -313,10 +313,12 @@ void rt6_bind_peer(struct rt6_info *rt, int create)
return;
peer = inet_getpeer_v6(base, &rt->rt6i_dst.addr, create);
if (!rt6_set_peer(rt, peer))
inet_putpeer(peer);
else
rt->rt6i_peer_genid = rt6_peer_genid();
if (peer) {
if (!rt6_set_peer(rt, peer))
inet_putpeer(peer);
else
rt->rt6i_peer_genid = rt6_peer_genid();
}
}
static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,