diff options
| author | cem <cem@FreeBSD.org> | 2016-04-26 20:27:17 +0000 |
|---|---|---|
| committer | cem <cem@FreeBSD.org> | 2016-04-26 20:27:17 +0000 |
| commit | 5abde16df3b39ca89396e1ba8e675c205ec76f94 (patch) | |
| tree | c053162b997f9f47a52522bfece9b0059e90a486 /sys/net | |
| parent | 6d897538e279d6b51735ab2aa14b15f213ad3467 (diff) | |
| download | FreeBSD-src-5abde16df3b39ca89396e1ba8e675c205ec76f94.zip FreeBSD-src-5abde16df3b39ca89396e1ba8e675c205ec76f94.tar.gz | |
radix_mpath: Don't derefence a NULL pointer in for loop iteration
It seems rn_dupedkey may be NULL, because of the NULL check inside the loop.
(Also, the rt gets assigned from rn_dupedkey and NULL checked at top of loop.)
However, the for-loop update condition happens before the top-of-loop check and
dereferences 'rt' unconditionally.
Instead, NULL-check before dereferencing.
If rn_dupedkey cannot in fact be NULL, or something else protects this, feel
free to revert this and add an ASSERT of some kind instead.
This was introduced in r191080 (2009) and moved around slightly in r293657.
Reported by: Coverity
CID: 1348482
Sponsored by: EMC / Isilon Storage Division
Diffstat (limited to 'sys/net')
| -rw-r--r-- | sys/net/radix_mpath.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/net/radix_mpath.c b/sys/net/radix_mpath.c index c02f0ff..d3ce92c 100644 --- a/sys/net/radix_mpath.c +++ b/sys/net/radix_mpath.c @@ -223,7 +223,7 @@ rt_mpath_selectrte(struct rtentry *rte, uint32_t hash) hash %= total_weight; for (weight = abs((int32_t)hash); rt != NULL && weight >= rt->rt_weight; - weight -= rt->rt_weight) { + weight -= (rt == NULL) ? 0 : rt->rt_weight) { /* stay within the multipath routes */ if (rn->rn_dupedkey && rn->rn_mask != rn->rn_dupedkey->rn_mask) |
