inet: Avoid potential NULL peer dereference.

We handle NULL in rt{,6}_set_peer but then our caller will try to pass
that NULL pointer into inet_putpeer() which isn't ready for it.

Fix this by moving the NULL check one level up, and then remove the
now unnecessary NULL check from inetpeer_ptr_set_peer().

Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 6 insertions, 4 deletions

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index d9ba4808f26a..58a3ec23da2f 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -313,10 +313,12 @@ void rt6_bind_peer(struct rt6_info *rt, int create)
                 return;
 
         peer = inet_getpeer_v6(base, &rt->rt6i_dst.addr, create);
-        if (!rt6_set_peer(rt, peer))
-                inet_putpeer(peer);
-        else
-                rt->rt6i_peer_genid = rt6_peer_genid();
+        if (peer) {
+                if (!rt6_set_peer(rt, peer))
+                        inet_putpeer(peer);
+                else
+                        rt->rt6i_peer_genid = rt6_peer_genid();
+        }
 }
 
 static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,