From patchwork Mon Oct 29 03:50:20 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amerigo Wang X-Patchwork-Id: 194788 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 1224D2C00A3 for ; Mon, 29 Oct 2012 14:50:34 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756164Ab2J2Dub (ORCPT ); Sun, 28 Oct 2012 23:50:31 -0400 Received: from mx1.redhat.com ([209.132.183.28]:34474 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753814Ab2J2Dua (ORCPT ); Sun, 28 Oct 2012 23:50:30 -0400 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q9T3oTTN004484 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Sun, 28 Oct 2012 23:50:30 -0400 Received: from cr0.redhat.com (vpn-246-122.nrt.redhat.com [10.64.246.122]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id q9T3oRu1011462; Sun, 28 Oct 2012 23:50:28 -0400 From: Cong Wang To: netdev@vger.kernel.org Cc: "David S. Miller" , Cong Wang Subject: [Patch net-next] ipv6: fix a potential NULL deref Date: Mon, 29 Oct 2012 11:50:20 +0800 Message-Id: <1351482620-11008-1-git-send-email-amwang@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.23 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org In ipv6_del_addr(): if (rt != net->ipv6.ip6_null_entry && addrconf_is_prefix_route(rt)) { if (onlink == 0) { ip6_del_rt(rt); rt = NULL; } else if (!(rt->rt6i_flags & RTF_EXPIRES)) { rt6_set_expires(rt, expires); } } dst_release(&rt->dst); obviously rt could be NULL'd before dst_release(), so we have to check if rt is NULL before calling it. Reported-by: Fengguang Wu Cc: David S. Miller Signed-off-by: Cong Wang --- -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index 8f0b12a..c467dbb 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -951,7 +951,8 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp) rt6_set_expires(rt, expires); } } - dst_release(&rt->dst); + if (rt) + dst_release(&rt->dst); } /* clean up prefsrc entries */