If rhashtable_remove_fast returns an error, a rollback is applied. In that case, an unchecked dereference has been fixed.
Reported-by: kernel test robot <l...@intel.com> Reported-by: Dan Carpenter <dan.carpen...@oracle.com> Signed-off-by: Justin Iurman <justin.iur...@uliege.be> --- net/ipv6/ioam6.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/ipv6/ioam6.c b/net/ipv6/ioam6.c index e414e915bf1e..f1347940245e 100644 --- a/net/ipv6/ioam6.c +++ b/net/ipv6/ioam6.c @@ -161,7 +161,8 @@ static int ioam6_genl_delns(struct sk_buff *skb, struct genl_info *info) err = rhashtable_remove_fast(&nsdata->namespaces, &ns->head, rht_ns_params); if (err) { - ns->schema->ns = ns; + if (ns->schema) + ns->schema->ns = ns; goto out_unlock; } @@ -355,7 +356,8 @@ static int ioam6_genl_delsc(struct sk_buff *skb, struct genl_info *info) err = rhashtable_remove_fast(&nsdata->schemas, &sc->head, rht_sc_params); if (err) { - sc->ns->schema = sc; + if (sc->ns) + sc->ns->schema = sc; goto out_unlock; } -- 2.17.1