net_sched: properly handle failure case of tcf_exts_init()

After commit 22dc13c837c3 ("net_sched: convert tcf_exts from list to pointer array")
we do dynamic allocation in tcf_exts_init(), therefore we need
to handle the ENOMEM case properly.

Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 10 insertions, 4 deletions

diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index 08a3b0a6f5ab..c91e65d81a48 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -383,17 +383,19 @@ static int route4_set_parms(struct net *net, struct tcf_proto *tp,
                             struct nlattr **tb, struct nlattr *est, int new,
                             bool ovr)
 {
-        int err;
         u32 id = 0, to = 0, nhandle = 0x8000;
         struct route4_filter *fp;
         unsigned int h1;
         struct route4_bucket *b;
         struct tcf_exts e;
+        int err;
 
-        tcf_exts_init(&e, TCA_ROUTE4_ACT, TCA_ROUTE4_POLICE);
-        err = tcf_exts_validate(net, tp, tb, est, &e, ovr);
+        err = tcf_exts_init(&e, TCA_ROUTE4_ACT, TCA_ROUTE4_POLICE);
         if (err < 0)
                 return err;
+        err = tcf_exts_validate(net, tp, tb, est, &e, ovr);
+        if (err < 0)
+                goto errout;
 
         err = -EINVAL;
         if (tb[TCA_ROUTE4_TO]) {
@@ -503,7 +505,10 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
         if (!f)
                 goto errout;
 
-        tcf_exts_init(&f->exts, TCA_ROUTE4_ACT, TCA_ROUTE4_POLICE);
+        err = tcf_exts_init(&f->exts, TCA_ROUTE4_ACT, TCA_ROUTE4_POLICE);
+        if (err < 0)
+                goto errout;
+
         if (fold) {
                 f->id = fold->id;
                 f->iif = fold->iif;
@@ -557,6 +562,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
         return 0;
 
 errout:
+        tcf_exts_destroy(&f->exts);
         kfree(f);
         return err;
 }