aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorPatrick McHardy <kaber@trash.net>2007-03-25 01:13:06 -0400
committerDavid S. Miller <davem@sunset.davemloft.net>2007-03-25 21:48:11 -0400
commitd3fa76ee6b4a8dd0efda4e78e96f5b19533b3dea (patch)
treef960e24f323770fd3f26b0b14107cf3b0c0c0024 /net
parentc93a882ebe673b5e6da0a70fd433f7517e032d23 (diff)
[NET_SCHED]: cls_basic: fix NULL pointer dereference
cls_basic doesn't allocate tp->root before it is linked into the active classifier list, resulting in a NULL pointer dereference when packets hit the classifier before its ->change function is called. Reported by Chris Madden <chris@reflexsecurity.com> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/sched/cls_basic.c16
1 files changed, 7 insertions, 9 deletions
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index fad08e521c24..70fe36eb66a2 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -81,6 +81,13 @@ static void basic_put(struct tcf_proto *tp, unsigned long f)
81 81
82static int basic_init(struct tcf_proto *tp) 82static int basic_init(struct tcf_proto *tp)
83{ 83{
84 struct basic_head *head;
85
86 head = kzalloc(sizeof(*head), GFP_KERNEL);
87 if (head == NULL)
88 return -ENOBUFS;
89 INIT_LIST_HEAD(&head->flist);
90 tp->root = head;
84 return 0; 91 return 0;
85} 92}
86 93
@@ -176,15 +183,6 @@ static int basic_change(struct tcf_proto *tp, unsigned long base, u32 handle,
176 } 183 }
177 184
178 err = -ENOBUFS; 185 err = -ENOBUFS;
179 if (head == NULL) {
180 head = kzalloc(sizeof(*head), GFP_KERNEL);
181 if (head == NULL)
182 goto errout;
183
184 INIT_LIST_HEAD(&head->flist);
185 tp->root = head;
186 }
187
188 f = kzalloc(sizeof(*f), GFP_KERNEL); 186 f = kzalloc(sizeof(*f), GFP_KERNEL);
189 if (f == NULL) 187 if (f == NULL)
190 goto errout; 188 goto errout;