From d3fa76ee6b4a8dd0efda4e78e96f5b19533b3dea Mon Sep 17 00:00:00 2001 From: Patrick McHardy Date: Sat, 24 Mar 2007 22:13:06 -0700 Subject: [NET_SCHED]: cls_basic: fix NULL pointer dereference cls_basic doesn't allocate tp->root before it is linked into the active classifier list, resulting in a NULL pointer dereference when packets hit the classifier before its ->change function is called. Reported by Chris Madden Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller --- net/sched/cls_basic.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) (limited to 'net/sched/cls_basic.c') diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c index fad08e521c24..70fe36eb66a2 100644 --- a/net/sched/cls_basic.c +++ b/net/sched/cls_basic.c @@ -81,6 +81,13 @@ static void basic_put(struct tcf_proto *tp, unsigned long f) static int basic_init(struct tcf_proto *tp) { + struct basic_head *head; + + head = kzalloc(sizeof(*head), GFP_KERNEL); + if (head == NULL) + return -ENOBUFS; + INIT_LIST_HEAD(&head->flist); + tp->root = head; return 0; } @@ -176,15 +183,6 @@ static int basic_change(struct tcf_proto *tp, unsigned long base, u32 handle, } err = -ENOBUFS; - if (head == NULL) { - head = kzalloc(sizeof(*head), GFP_KERNEL); - if (head == NULL) - goto errout; - - INIT_LIST_HEAD(&head->flist); - tp->root = head; - } - f = kzalloc(sizeof(*f), GFP_KERNEL); if (f == NULL) goto errout; -- cgit v1.2.2 From 31ba548f9683c5c5809567549b404404b6017088 Mon Sep 17 00:00:00 2001 From: Patrick McHardy Date: Fri, 30 Mar 2007 13:36:23 -0700 Subject: [NET_SCHED]: cls_basic: fix memory leak in basic_destroy tp->root is not freed on destruction. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller --- net/sched/cls_basic.c | 1 + 1 file changed, 1 insertion(+) (limited to 'net/sched/cls_basic.c') diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c index 70fe36eb66a2..4a91f082a81d 100644 --- a/net/sched/cls_basic.c +++ b/net/sched/cls_basic.c @@ -109,6 +109,7 @@ static void basic_destroy(struct tcf_proto *tp) list_del(&f->link); basic_delete_filter(tp, f); } + kfree(head); } static int basic_delete(struct tcf_proto *tp, unsigned long arg) -- cgit v1.2.2