[src/trunk]: src/sys/netinet Call rtcache_unref() only when the checks succee...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/628dda2c7b16
branches:  trunk
changeset: 846421:628dda2c7b16
user:      maxv <maxv%NetBSD.org@localhost>
date:      Sat Nov 16 10:15:10 2019 +0000

description:
Call rtcache_unref() only when the checks succeed, instead of relying on
another NULL check in rtcache_unref().

Because, in order to resolve the address of the second argument, we do a
dereference on 'tp', which is theoretically allowed to be NULL. The five
callers of nd6_hint() never pass a NULL argument however, so by luck the
actual NULL deref never happens.

Maybe the NULL check on 'tp' in should be replaced to a KASSERT ensuring
it isn't NULL, for clarity.

Reported by kUBSan.

diffstat:

 sys/netinet/tcp_input.c |  9 +++++----
 1 files changed, 5 insertions(+), 4 deletions(-)

diffs (31 lines):

diff -r 33b3f1890fb7 -r 628dda2c7b16 sys/netinet/tcp_input.c
--- a/sys/netinet/tcp_input.c   Sat Nov 16 10:07:53 2019 +0000
+++ b/sys/netinet/tcp_input.c   Sat Nov 16 10:15:10 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: tcp_input.c,v 1.416 2019/09/25 19:06:30 jnemeth Exp $  */
+/*     $NetBSD: tcp_input.c,v 1.417 2019/11/16 10:15:10 maxv Exp $     */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -148,7 +148,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: tcp_input.c,v 1.416 2019/09/25 19:06:30 jnemeth Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tcp_input.c,v 1.417 2019/11/16 10:15:10 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -260,9 +260,10 @@
        struct rtentry *rt = NULL;
 
        if (tp != NULL && tp->t_in6pcb != NULL && tp->t_family == AF_INET6 &&
-           (rt = rtcache_validate(&tp->t_in6pcb->in6p_route)) != NULL)
+           (rt = rtcache_validate(&tp->t_in6pcb->in6p_route)) != NULL) {
                nd6_nud_hint(rt);
-       rtcache_unref(rt, &tp->t_in6pcb->in6p_route);
+               rtcache_unref(rt, &tp->t_in6pcb->in6p_route);
+       }
 }
 #else
 static inline void