[X25] x25_forward_call(): fix NULL dereferences

This patch fixes two NULL dereferences spotted by the Coverity checker.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/x25/x25_forward.c b/net/x25/x25_forward.c
index d339e0c810a820096dd6c040245d5256fe5065f1..8738ec7ce69336dd1960d9e3c8c9a0e1fa68a0e4 100644 (file)
--- a/net/x25/x25_forward.c
+++ b/net/x25/x25_forward.c
@@ -26,64 +26,66 @@ int x25_forward_call(struct x25_address *dest_addr, struct x25_neigh *from,
        short same_lci = 0;
        int rc = 0;
 
-       if ((rt = x25_get_route(dest_addr)) != NULL) {
+       if ((rt = x25_get_route(dest_addr)) == NULL)
+               goto out_no_route;
 
-               if ((neigh_new = x25_get_neigh(rt->dev)) == NULL) {
-                       /* This shouldnt happen, if it occurs somehow
-                        * do something sensible
-                        */
-                       goto out_put_route;
-               }
-
-               /* Avoid a loop. This is the normal exit path for a
-                * system with only one x.25 iface and default route
+       if ((neigh_new = x25_get_neigh(rt->dev)) == NULL) {
+               /* This shouldnt happen, if it occurs somehow
+                * do something sensible
                 */
-               if (rt->dev == from->dev) {
-                       goto out_put_nb;
-               }
+               goto out_put_route;
+       }
 
-               /* Remote end sending a call request on an already
-                * established LCI? It shouldnt happen, just in case..
-                */
-               read_lock_bh(&x25_forward_list_lock);
-               list_for_each(entry, &x25_forward_list) {
-                       x25_frwd = list_entry(entry, struct x25_forward, node);
-                       if (x25_frwd->lci == lci) {
-                               printk(KERN_WARNING "X.25: call request for lci which is already registered!, transmitting but not registering new pair\n");
-                               same_lci = 1;
-                       }
-               }
-               read_unlock_bh(&x25_forward_list_lock);
-
-               /* Save the forwarding details for future traffic */
-               if (!same_lci){
-                       if ((new_frwd = kmalloc(sizeof(struct x25_forward),
-                                                       GFP_ATOMIC)) == NULL){
-                               rc = -ENOMEM;
-                               goto out_put_nb;
-                       }
-                       new_frwd->lci = lci;
-                       new_frwd->dev1 = rt->dev;
-                       new_frwd->dev2 = from->dev;
-                       write_lock_bh(&x25_forward_list_lock);
-                       list_add(&new_frwd->node, &x25_forward_list);
-                       write_unlock_bh(&x25_forward_list_lock);
+       /* Avoid a loop. This is the normal exit path for a
+        * system with only one x.25 iface and default route
+        */
+       if (rt->dev == from->dev) {
+               goto out_put_nb;
+       }
+
+       /* Remote end sending a call request on an already
+        * established LCI? It shouldnt happen, just in case..
+        */
+       read_lock_bh(&x25_forward_list_lock);
+       list_for_each(entry, &x25_forward_list) {
+               x25_frwd = list_entry(entry, struct x25_forward, node);
+               if (x25_frwd->lci == lci) {
+                       printk(KERN_WARNING "X.25: call request for lci which is already registered!, transmitting but not registering new pair\n");
+                       same_lci = 1;
                }
+       }
+       read_unlock_bh(&x25_forward_list_lock);
 
-               /* Forward the call request */
-               if ( (skbn = skb_clone(skb, GFP_ATOMIC)) == NULL){
+       /* Save the forwarding details for future traffic */
+       if (!same_lci){
+               if ((new_frwd = kmalloc(sizeof(struct x25_forward),
+                                               GFP_ATOMIC)) == NULL){
+                       rc = -ENOMEM;
                        goto out_put_nb;
                }
-               x25_transmit_link(skbn, neigh_new);
-               rc = 1;
+               new_frwd->lci = lci;
+               new_frwd->dev1 = rt->dev;
+               new_frwd->dev2 = from->dev;
+               write_lock_bh(&x25_forward_list_lock);
+               list_add(&new_frwd->node, &x25_forward_list);
+               write_unlock_bh(&x25_forward_list_lock);
        }
 
+       /* Forward the call request */
+       if ( (skbn = skb_clone(skb, GFP_ATOMIC)) == NULL){
+               goto out_put_nb;
+       }
+       x25_transmit_link(skbn, neigh_new);
+       rc = 1;
+
 
 out_put_nb:
        x25_neigh_put(neigh_new);
 
 out_put_route:
        x25_route_put(rt);
+
+out_no_route:
        return rc;
 }