diff options
| author | Patrick McHardy <kaber@trash.net> | 2007-03-28 21:56:42 +0200 |
|---|---|---|
| committer | Adrian Bunk <bunk@stusta.de> | 2007-03-28 21:56:42 +0200 |
| commit | 93e6aebaa0fb7db45b9f36ce7090024b5de02682 (patch) | |
| tree | d94b4a68aefb004e61d238483969ed4f67e858c7 /net/sched | |
| parent | b48ebb90b39f5639a72cfbce4417e5d009a0db7c (diff) | |
[NET_SCHED]: cls_basic: fix NULL pointer dereference
cls_basic doesn't allocate tp->root before it is linked into the
active classifier list, resulting in a NULL pointer dereference
when packets hit the classifier before its ->change function is
called.
Reported by Chris Madden <chris@reflexsecurity.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Diffstat (limited to 'net/sched')
| -rw-r--r-- | net/sched/cls_basic.c | 17 |
1 files changed, 7 insertions, 10 deletions
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c index 0f425448fdf..5c29129ec92 100644 --- a/net/sched/cls_basic.c +++ b/net/sched/cls_basic.c @@ -83,6 +83,13 @@ static void basic_put(struct tcf_proto *tp, unsigned long f) static int basic_init(struct tcf_proto *tp) { + struct basic_head *head; + + head = kzalloc(sizeof(*head), GFP_KERNEL); + if (head == NULL) + return -ENOBUFS; + INIT_LIST_HEAD(&head->flist); + tp->root = head; return 0; } @@ -178,16 +185,6 @@ static int basic_change(struct tcf_proto *tp, unsigned long base, u32 handle, } err = -ENOBUFS; - if (head == NULL) { - head = kmalloc(sizeof(*head), GFP_KERNEL); - if (head == NULL) - goto errout; - - memset(head, 0, sizeof(*head)); - INIT_LIST_HEAD(&head->flist); - tp->root = head; - } - f = kmalloc(sizeof(*f), GFP_KERNEL); if (f == NULL) goto errout; |