From owner-svn-src-all@freebsd.org Fri Jan 15 13:47:13 2016 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 3872EA83425; Fri, 15 Jan 2016 13:47:13 +0000 (UTC) (envelope-from melifaro@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 096C8184D; Fri, 15 Jan 2016 13:47:12 +0000 (UTC) (envelope-from melifaro@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u0FDlCDX044395; Fri, 15 Jan 2016 13:47:12 GMT (envelope-from melifaro@FreeBSD.org) Received: (from melifaro@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id u0FDlCkv044394; Fri, 15 Jan 2016 13:47:12 GMT (envelope-from melifaro@FreeBSD.org) Message-Id: <201601151347.u0FDlCkv044394@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: melifaro set sender to melifaro@FreeBSD.org using -f From: "Alexander V. Chernikov" Date: Fri, 15 Jan 2016 13:47:12 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r294089 - head/sys/net X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jan 2016 13:47:13 -0000 Author: melifaro Date: Fri Jan 15 13:47:11 2016 New Revision: 294089 URL: https://svnweb.freebsd.org/changeset/base/294089 Log: Clean up original route path selection logic a bit. NULL pointer dereference claimed by Coverity was possible if one (or several) next-hops for had their weights set to 0. CID: 1348482 Modified: head/sys/net/radix_mpath.c Modified: head/sys/net/radix_mpath.c ============================================================================== --- head/sys/net/radix_mpath.c Fri Jan 15 12:09:15 2016 (r294088) +++ head/sys/net/radix_mpath.c Fri Jan 15 13:47:11 2016 (r294089) @@ -201,19 +201,20 @@ static struct rtentry * rt_mpath_selectrte(struct rtentry *rte, uint32_t hash) { struct radix_node *rn0, *rn; - u_int32_t n; + uint32_t total_weight; struct rtentry *rt; int64_t weight; /* beyond here, we use rn as the master copy */ rn0 = rn = (struct radix_node *)rte; - n = rn_mpath_count(rn0); + rt = rte; /* gw selection by Modulo-N Hash (RFC2991) XXX need improvement? */ + total_weight = rn_mpath_count(rn0); hash += hashjitter; - hash %= n; - for (weight = abs((int32_t)hash), rt = rte; - weight >= rt->rt_weight && rn; + hash %= total_weight; + for (weight = abs((int32_t)hash); + rt != NULL && weight >= rt->rt_weight; weight -= rt->rt_weight) { /* stay within the multipath routes */