[PATCH] inet: Fix BUG triggered by __rt{,6}_get_peer().

[David Miller <davem@xxxxxxxxxxxxx>]

If no peer actually gets attached (either because create is zero or
the peer allocation fails) we'll trigger a BUG because we
unconditionally do an rt{,6}_peer_ptr() afterwards.

Fix this by guarding it with the proper check.

Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
---
 include/net/ip6_route.h |    2 +-
 include/net/route.h     |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index f88a85c..a2cda24 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -61,7 +61,7 @@ static inline struct inet_peer *__rt6_get_peer(struct rt6_info *rt, int create)
 		return rt6_peer_ptr(rt);
 
 	rt6_bind_peer(rt, create);
-	return rt6_peer_ptr(rt);
+	return (rt6_has_peer(rt) ? rt6_peer_ptr(rt) : NULL);
 }
 
 static inline struct inet_peer *rt6_get_peer(struct rt6_info *rt)
diff --git a/include/net/route.h b/include/net/route.h
index cc693a5..2bfbc93 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -334,7 +334,7 @@ static inline struct inet_peer *__rt_get_peer(struct rtable *rt, __be32 daddr, i
 		return rt_peer_ptr(rt);
 
 	rt_bind_peer(rt, daddr, create);
-	return rt_peer_ptr(rt);
+	return (rt_has_peer(rt) ? rt_peer_ptr(rt) : NULL);
 }
 
 static inline struct inet_peer *rt_get_peer(struct rtable *rt, __be32 daddr)
-- 
1.7.10

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html