If rhashtable_remove_fast returns an error, a rollback is applied. In
that case, an unchecked dereference has been fixed.

Reported-by: kernel test robot <l...@intel.com>
Reported-by: Dan Carpenter <dan.carpen...@oracle.com>
Signed-off-by: Justin Iurman <justin.iur...@uliege.be>
---
 net/ipv6/ioam6.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/ipv6/ioam6.c b/net/ipv6/ioam6.c
index e414e915bf1e..f1347940245e 100644
--- a/net/ipv6/ioam6.c
+++ b/net/ipv6/ioam6.c
@@ -161,7 +161,8 @@ static int ioam6_genl_delns(struct sk_buff *skb, struct 
genl_info *info)
        err = rhashtable_remove_fast(&nsdata->namespaces, &ns->head,
                                     rht_ns_params);
        if (err) {
-               ns->schema->ns = ns;
+               if (ns->schema)
+                       ns->schema->ns = ns;
                goto out_unlock;
        }
 
@@ -355,7 +356,8 @@ static int ioam6_genl_delsc(struct sk_buff *skb, struct 
genl_info *info)
        err = rhashtable_remove_fast(&nsdata->schemas, &sc->head,
                                     rht_sc_params);
        if (err) {
-               sc->ns->schema = sc;
+               if (sc->ns)
+                       sc->ns->schema = sc;
                goto out_unlock;
        }
 
-- 
2.17.1

Reply via email to