ip: fix error handling in ip_finish_output2()
authorVasiliy Kulikov <segoon@openwall.com>
Mon, 6 Aug 2012 03:55:29 +0000 (03:55 +0000)
committerDavid S. Miller <davem@davemloft.net>
Mon, 6 Aug 2012 20:30:01 +0000 (13:30 -0700)
__neigh_create() returns either a pointer to struct neighbour or PTR_ERR().
But the caller expects it to return either a pointer or NULL.  Replace
the NULL check with IS_ERR() check.

The bug was introduced in a263b3093641fb1ec377582c90986a7fd0625184
("ipv4: Make neigh lookups directly in output packet path.").

Signed-off-by: Vasily Kulikov <segoon@openwall.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/ip_output.c

index ba39a52d18c1966209b02127ad7a4335479fcbdc..76dde25fb9a042376339d58b4f93ba1e0056f695 100644 (file)
@@ -197,7 +197,7 @@ static inline int ip_finish_output2(struct sk_buff *skb)
        neigh = __ipv4_neigh_lookup_noref(dev, nexthop);
        if (unlikely(!neigh))
                neigh = __neigh_create(&arp_tbl, &nexthop, dev, false);
-       if (neigh) {
+       if (!IS_ERR(neigh)) {
                int res = dst_neigh_output(dst, neigh, skb);
 
                rcu_read_unlock_bh();