diff options
| author | Vasiliy Kulikov <segoon@openwall.com> | 2012-08-06 05:55:29 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2012-08-06 22:30:01 +0200 |
| commit | 9871f1ad677d95ffeca80e2c21b70af9bfc9cc91 (patch) | |
| tree | 85e0fc87c1df524a936d2c0d61a86bd9f994c760 /net/ipv4/ip_output.c | |
| parent | llc: free the right skb (diff) | |
| download | linux-9871f1ad677d95ffeca80e2c21b70af9bfc9cc91.tar.xz linux-9871f1ad677d95ffeca80e2c21b70af9bfc9cc91.zip | |
ip: fix error handling in ip_finish_output2()
__neigh_create() returns either a pointer to struct neighbour or PTR_ERR().
But the caller expects it to return either a pointer or NULL. Replace
the NULL check with IS_ERR() check.
The bug was introduced in a263b3093641fb1ec377582c90986a7fd0625184
("ipv4: Make neigh lookups directly in output packet path.").
Signed-off-by: Vasily Kulikov <segoon@openwall.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/ip_output.c')
| -rw-r--r-- | net/ipv4/ip_output.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index ba39a52d18c1..76dde25fb9a0 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -197,7 +197,7 @@ static inline int ip_finish_output2(struct sk_buff *skb) neigh = __ipv4_neigh_lookup_noref(dev, nexthop); if (unlikely(!neigh)) neigh = __neigh_create(&arp_tbl, &nexthop, dev, false); - if (neigh) { + if (!IS_ERR(neigh)) { int res = dst_neigh_output(dst, neigh, skb); rcu_read_unlock_bh(); |