diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-08-16 16:15:02 +0300 |
|---|---|---|
| committer | Eric W. Biederman <ebiederm@xmission.com> | 2012-08-16 16:04:42 -0700 |
| commit | 898132ae76d1aeb52301f10e8795c34fbb54e853 (patch) | |
| tree | ae2b9b1482fdabf9456bd741bbd21e485cae8dd6 | |
| parent | 0625c883bc4b3eba6f93f268cf67b5664244c0fe (diff) | |
| download | op-kernel-dev-898132ae76d1aeb52301f10e8795c34fbb54e853.zip op-kernel-dev-898132ae76d1aeb52301f10e8795c34fbb54e853.tar.gz | |
ipv6: move dereference after check in fl_free()
There is a dereference before checking for NULL bug here. Generally
free() functions should accept NULL pointers. For example, fl_create()
can pass a NULL pointer to fl_free() on the error path.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
| -rw-r--r-- | net/ipv6/ip6_flowlabel.c | 7 |
1 files changed, 2 insertions, 5 deletions
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c index c836a6a..90bbefb 100644 --- a/net/ipv6/ip6_flowlabel.c +++ b/net/ipv6/ip6_flowlabel.c @@ -91,12 +91,9 @@ static struct ip6_flowlabel *fl_lookup(struct net *net, __be32 label) static void fl_free(struct ip6_flowlabel *fl) { - switch (fl->share) { - case IPV6_FL_S_PROCESS: - put_pid(fl->owner.pid); - break; - } if (fl) { + if (fl->share == IPV6_FL_S_PROCESS) + put_pid(fl->owner.pid); release_net(fl->fl_net); kfree(fl->opt); } |
