diff options
| author | Paolo Abeni <pabeni@redhat.com> | 2017-05-02 17:03:58 +0300 |
|---|---|---|
| committer | Doug Ledford <dledford@redhat.com> | 2017-05-02 17:45:45 +0300 |
| commit | 24b43c99647bf9be4995e6a6c9c3a923c147770a (patch) | |
| tree | 2318075dcfbd29e3d91ccb9d234473e49f51eaa9 /drivers/infiniband | |
| parent | 87f0faadc68534668802a85ae670435bc90830b3 (diff) | |
| download | linux-24b43c99647bf9be4995e6a6c9c3a923c147770a.tar.xz | |
infiniband: avoid dereferencing uninitialized dst on error path
With commit eea40b8f624f ("infiniband: call ipv6 route lookup
via the stub interface"), if the route lookup fails due to
ipv6 being disabled, the dst variable is left untouched, and
the following dst_release() may access uninitialized memory.
Since ipv6_dst_lookup() always sets dst to NULL in case of
lookup failure with ipv6 enabled, fix the above just
returning the error code if the lookup fails.
Fixes: eea40b8f624 ("infiniband: call ipv6 route lookup via the stub interface")
Reported-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers/infiniband')
| -rw-r--r-- | drivers/infiniband/core/addr.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c index 523d24320100..02971e239a18 100644 --- a/drivers/infiniband/core/addr.c +++ b/drivers/infiniband/core/addr.c @@ -446,7 +446,7 @@ static int addr6_resolve(struct sockaddr_in6 *src_in, ret = ipv6_stub->ipv6_dst_lookup(addr->net, NULL, &dst, &fl6); if (ret < 0) - goto put; + return ret; rt = (struct rt6_info *)dst; if (ipv6_addr_any(&fl6.saddr)) { |