summaryrefslogtreecommitdiffstats
path: root/net/ipv4
diff options
context:
space:
mode:
authorAlexander Duyck <alexander.h.duyck@redhat.com>2015-03-23 11:51:53 -0700
committerDavid S. Miller <davem@davemloft.net>2015-03-23 16:58:32 -0400
commitb6f15f828d4b624a2e4306dabbbb20a581bece37 (patch)
tree78a27659a48bc7be32ef10407be3dfc21c440797 /net/ipv4
parent9cde94506eacfcda570b6c304b8deae1a7191ee2 (diff)
downloadlinux-b6f15f828d4b624a2e4306dabbbb20a581bece37.tar.bz2
fib_trie: Fix regression in handling of inflate/halve failure
When I updated the code to address a possible null pointer dereference in resize I ended up reverting an exception handling fix for the suffix length in the event that inflate or halve failed. This change is meant to correct that by reverting the earlier fix and instead simply getting the parent again after inflate has been completed to avoid the possible null pointer issue. Fixes: ddb4b9a13 ("fib_trie: Address possible NULL pointer dereference in resize") Signed-off-by: Alexander Duyck <alexander.h.duyck@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4')
-rw-r--r--net/ipv4/fib_trie.c13
1 files changed, 9 insertions, 4 deletions
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index e3b4aee4244e..2c7c299ee2b9 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -830,7 +830,7 @@ static struct key_vector *resize(struct trie *t, struct key_vector *tn)
/* Double as long as the resulting node has a number of
* nonempty nodes that are above the threshold.
*/
- while (should_inflate(tp, tn) && max_work--) {
+ while (should_inflate(tp, tn) && max_work) {
tp = inflate(t, tn);
if (!tp) {
#ifdef CONFIG_IP_FIB_TRIE_STATS
@@ -839,17 +839,21 @@ static struct key_vector *resize(struct trie *t, struct key_vector *tn)
break;
}
+ max_work--;
tn = get_child(tp, cindex);
}
+ /* update parent in case inflate failed */
+ tp = node_parent(tn);
+
/* Return if at least one inflate is run */
if (max_work != MAX_WORK)
- return node_parent(tn);
+ return tp;
/* Halve as long as the number of empty children in this
* node is above threshold.
*/
- while (should_halve(tp, tn) && max_work--) {
+ while (should_halve(tp, tn) && max_work) {
tp = halve(t, tn);
if (!tp) {
#ifdef CONFIG_IP_FIB_TRIE_STATS
@@ -858,6 +862,7 @@ static struct key_vector *resize(struct trie *t, struct key_vector *tn)
break;
}
+ max_work--;
tn = get_child(tp, cindex);
}
@@ -865,7 +870,7 @@ static struct key_vector *resize(struct trie *t, struct key_vector *tn)
if (should_collapse(tn))
return collapse(t, tn);
- /* update parent in case inflate or halve failed */
+ /* update parent in case halve failed */
tp = node_parent(tn);
/* Return if at least one deflate was run */