10375 uts: NULL pointer issues in ip module

Reviewed by: Andy Fiddaman <andy@omniosce.org>
Reviewed by: Rob Johnston <rob.johnston@joyent.com>
Approved by: Dan McDonald <danmcd@joyent.com>

7 files changed, 11 insertions, 10 deletions

diff --git a/usr/src/uts/common/inet/ip/ip.c b/usr/src/uts/common/inet/ip/ip.c
index 748d4a0fd0..18f67573be 100644
--- a/usr/src/uts/common/inet/ip/ip.c
+++ b/usr/src/uts/common/inet/ip/ip.c
@@ -15104,7 +15104,7 @@ ip_get_zoneid_v4(ipaddr_t addr, mblk_t *mp, ip_recv_attr_t *ira,
 
 	if (lookup_zoneid != ALL_ZONES)
 		ire_flags |= MATCH_IRE_ZONEONLY;
-	ire = ire_ftable_lookup_v4(addr, NULL, NULL, IRE_LOCAL | IRE_LOOPBACK,
+	ire = ire_ftable_lookup_v4(addr, 0, 0, IRE_LOCAL | IRE_LOOPBACK,
 	    NULL, lookup_zoneid, NULL, ire_flags, 0, ipst, NULL);
 	if (ire != NULL) {
 		zoneid = IP_REAL_ZONEID(ire->ire_zoneid, ipst);
diff --git a/usr/src/uts/common/inet/ip/ip6.c b/usr/src/uts/common/inet/ip/ip6.c
index e0c6706dd9..9c7f6b4000 100644
--- a/usr/src/uts/common/inet/ip/ip6.c
+++ b/usr/src/uts/common/inet/ip/ip6.c
@@ -2116,7 +2116,7 @@ ip_set_destination_v6(in6_addr_t *src_addrp, const in6_addr_t *dst_addr,
 	}
 	if (!(ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE))) {
 		/* Get an nce to cache. */
-		nce = ire_to_nce(ire, NULL, firsthop);
+		nce = ire_to_nce(ire, 0, firsthop);
 		if (nce == NULL) {
 			/* Allocation failure? */
 			ixa->ixa_ire_generation = IRE_GENERATION_VERIFY;
diff --git a/usr/src/uts/common/inet/ip/ip6_ire.c b/usr/src/uts/common/inet/ip/ip6_ire.c
index 979ca02a3b..ad738bc3b7 100644
--- a/usr/src/uts/common/inet/ip/ip6_ire.c
+++ b/usr/src/uts/common/inet/ip/ip6_ire.c
@@ -126,7 +126,7 @@ ire_init_v6(ire_t *ire, const in6_addr_t *v6addr, const in6_addr_t *v6mask,
 
 	error = ire_init_common(ire, type, ill, zoneid, flags, IPV6_VERSION,
 	    gc, ipst);
-	if (error != NULL)
+	if (error != 0)
 		return (error);
 
 	/* Determine which function pointers to use */
diff --git a/usr/src/uts/common/inet/ip/ip_attr.c b/usr/src/uts/common/inet/ip/ip_attr.c
index c350d67c2d..28379001d0 100644
--- a/usr/src/uts/common/inet/ip/ip_attr.c
+++ b/usr/src/uts/common/inet/ip/ip_attr.c
@@ -1390,7 +1390,7 @@ ixa_check_drain_insert(conn_t *connp, ip_xmit_attr_t *ixa)
 
 	if (idd->idd_tx_fctl_df(idd->idd_tx_fctl_dh, cookie) == 0) {
 		DTRACE_PROBE1(ill__tx__not__blocked, uintptr_t, cookie);
-	} else if (idl_txl->txl_cookie != NULL &&
+	} else if (idl_txl->txl_cookie != (uintptr_t)NULL &&
 	    idl_txl->txl_cookie != ixa->ixa_cookie) {
 		DTRACE_PROBE2(ill__tx__cookie__collision, uintptr_t, cookie,
 		    uintptr_t, idl_txl->txl_cookie);
diff --git a/usr/src/uts/common/inet/ip/ip_ire.c b/usr/src/uts/common/inet/ip/ip_ire.c
index 533713eddd..f44c91fcb9 100644
--- a/usr/src/uts/common/inet/ip/ip_ire.c
+++ b/usr/src/uts/common/inet/ip/ip_ire.c
@@ -543,7 +543,7 @@ ire_init_v4(ire_t *ire, uchar_t *addr, uchar_t *mask, uchar_t *gateway,
 
 	error = ire_init_common(ire, type, ill, zoneid, flags, IPV4_VERSION,
 	    gc, ipst);
-	if (error != NULL)
+	if (error != 0)
 		return (error);
 
 	/* Determine which function pointers to use */
diff --git a/usr/src/uts/common/inet/ip/ip_netinfo.c b/usr/src/uts/common/inet/ip/ip_netinfo.c
index c7532aa173..b86571e944 100644
--- a/usr/src/uts/common/inet/ip/ip_netinfo.c
+++ b/usr/src/uts/common/inet/ip/ip_netinfo.c
@@ -1092,18 +1092,18 @@ ip_routeto_impl(struct sockaddr *address, struct sockaddr *nexthop,
 	 */
 	if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
 		ire_refrele(ire);
-		return (NULL);
+		return ((uintptr_t)NULL);
 	}
 
 	nexthop_ire = ire_nexthop(ire);
 	if (nexthop_ire == NULL) {
 		ire_refrele(ire);
-		return (0);
+		return ((uintptr_t)NULL);
 	}
 	if (nexthop_ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
 		ire_refrele(nexthop_ire);
 		ire_refrele(ire);
-		return (0);
+		return ((uintptr_t)NULL);
 	}
 
 	ASSERT(nexthop_ire->ire_ill != NULL);
diff --git a/usr/src/uts/common/inet/sctp/sctp.c b/usr/src/uts/common/inet/sctp/sctp.c
index adc28ae129..51c68bba0a 100644
--- a/usr/src/uts/common/inet/sctp/sctp.c
+++ b/usr/src/uts/common/inet/sctp/sctp.c
@@ -1788,7 +1788,7 @@ sctp_find_next_tq(sctp_t *sctp)
 	for (try = 0; try < sctps->sctps_recvq_tq_list_cur_sz; try++) {
 		tq = sctps->sctps_recvq_tq_list[next_tq];
 		if (taskq_dispatch(tq, sctp_process_recvq, sctp,
-		    TQ_NOSLEEP) != NULL) {
+		    TQ_NOSLEEP) != (uintptr_t)NULL) {
 			sctp->sctp_recvq_tq = tq;
 			return (B_TRUE);
 		}
@@ -1803,7 +1803,8 @@ sctp_find_next_tq(sctp_t *sctp)
 	 */
 	sctp_inc_taskq(sctps);
 	tq = sctps->sctps_recvq_tq_list[sctps->sctps_recvq_tq_list_cur_sz - 1];
-	if (taskq_dispatch(tq, sctp_process_recvq, sctp, TQ_NOSLEEP) != NULL) {
+	if (taskq_dispatch(tq, sctp_process_recvq, sctp, TQ_NOSLEEP) !=
+	    (uintptr_t)NULL) {
 		sctp->sctp_recvq_tq = tq;
 		return (B_TRUE);
 	}