ipv4: fix NULL dereference in free_fib_info_rcu()

[karo-tx-linux.git] / net / ipv4 / fib_semantics.c

diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index b8d18171cca33ab5dab67408c3cd11ad57f25b83..ec3a9ce281a6ffb86b62e21f7284fd7c801668f0 100644 (file)
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1083,15 +1083,17 @@ struct fib_info *fib_create_info(struct fib_config *cfg,
        fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL);
        if (!fi)
                goto failure;
-       fib_info_cnt++;
        if (cfg->fc_mx) {
                fi->fib_metrics = kzalloc(sizeof(*fi->fib_metrics), GFP_KERNEL);
-               if (!fi->fib_metrics)
-                       goto failure;
+               if (unlikely(!fi->fib_metrics)) {
+                       kfree(fi);
+                       return ERR_PTR(err);
+               }
                atomic_set(&fi->fib_metrics->refcnt, 1);
-       } else
+       } else {
                fi->fib_metrics = (struct dst_metrics *)&dst_default_metrics;
-
+       }
+       fib_info_cnt++;
        fi->fib_net = net;
        fi->fib_protocol = cfg->fc_protocol;
        fi->fib_scope = cfg->fc_scope;