[PATCH v2] ipv6:ipv6_pinfo dereferenced after NULL check

From: Manjeet Pawar
Date: Thu Nov 24 2016 - 05:46:43 EST


From: Rohit Thapliyal <r.thapliyal@xxxxxxxxxxx>

np checked for NULL and then dereferenced. It should be modified
for NULL case.

Signed-off-by: Rohit Thapliyal <r.thapliyal@xxxxxxxxxxx>
Signed-off-by: Manjeet Pawar <manjeet.p@xxxxxxxxxxx>
Signed-off-by: Hannes Frederic Sowa <hannes@xxxxxxxxxxxxxxxxxxx>
Reviewed-by: Akhilesh Kumar <akhilesh.k@xxxxxxxxxxx>

---
v1->v2: Modified as per the suggestion of Hannes
np ? np->autoflowlabel : ip6_default_np_autolabel(net)

net/ipv6/ip6_output.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 59eb4ed..d734b5e 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -215,11 +215,14 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
*/
if (np)
hlimit = np->hop_limit;
+
if (hlimit < 0)
hlimit = ip6_dst_hoplimit(dst);

- ip6_flow_hdr(hdr, tclass, ip6_make_flowlabel(net, skb, fl6->flowlabel,
- np->autoflowlabel, fl6));
+ ip6_flow_hdr(hdr, tclass,
+ ip6_make_flowlabel(net, skb, fl6->flowlabel,
+ np ? np->autoflowlabel : ip6_default_np_autolabel(net),
+ fl6));

hdr->payload_len = htons(seg_len);
hdr->nexthdr = proto;
--
1.9.1