From patchwork Thu Oct 24 14:50:50 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christoph Paasch X-Patchwork-Id: 285931 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id D52C42C00AB for ; Fri, 25 Oct 2013 01:51:00 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755688Ab3JXOu5 (ORCPT ); Thu, 24 Oct 2013 10:50:57 -0400 Received: from mail-we0-f181.google.com ([74.125.82.181]:46526 "EHLO mail-we0-f181.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754998Ab3JXOu4 (ORCPT ); Thu, 24 Oct 2013 10:50:56 -0400 Received: by mail-we0-f181.google.com with SMTP id t60so2420841wes.40 for ; Thu, 24 Oct 2013 07:50:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id; bh=GZ0eqQ0eOaFiixElZGsv7dH5PCZdFFabFZot2SMpUnk=; b=ODNDZCT4Ewk2ePGELEKYX8irUdAZGaXM2LefsFf0jIS35m4UqwvspO2MR/spV+NjWg 8nV9PK0TRqAidvPiBJC13iu9h9f4nLDL5Tbe89BNatXUOgnZkBZqWjPeoHmLS9UBsVe0 2SELrPIgDcXxEjbf0eN+gXDdiyAJJgeDSO9/rBchskAjiC9+kIaLCqzBPKrqcbB0BNtm wkRzWfRMdODqUHHvrOHqsArlJToG9k3NDDjt4T/myYWLAUM2CsegT6A8vSwHIaFfe3d3 8cCcIzHeBPx91+oCgMy3gJ726/B3QZbw2DNEGZCwY6fTBL1WQqXDgcWxrnxAzA85YVdc 5LNA== X-Received: by 10.180.80.105 with SMTP id q9mr2627805wix.18.1382626254754; Thu, 24 Oct 2013 07:50:54 -0700 (PDT) Received: from localhost ([2001:6a8:3080:2:f466:f7f2:e059:84d5]) by mx.google.com with ESMTPSA id w10sm4255285wia.4.2013.10.24.07.50.53 for (version=TLSv1.2 cipher=RC4-SHA bits=128/128); Thu, 24 Oct 2013 07:50:53 -0700 (PDT) From: Christoph Paasch To: netdev@vger.kernel.org Cc: Eric Dumazet , David Miller , Jamal Hadi Salim , Jing Wang Subject: [PATCH net] net: sched: Don't free f before it is allocated in route4_change Date: Thu, 24 Oct 2013 16:50:50 +0200 Message-Id: <1382626250-15676-1-git-send-email-christoph.paasch@uclouvain.be> X-Mailer: git-send-email 1.8.3.2 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org f is set to *arg in route4_change at the beginning, which points to a route4_filter in the hash-table (gotten through route4_get, called by tc_ctl_filter). If the alloc of head fails, we should not goto errout, because this will free f and thus freed memory will be referenced by the hash-table. Only later the pointer f will change to an allocated route4_filter. This patch returns err if the allocation of head fails as f has not yet been allocated inside route4_change. Seems the code has been like this since Linus's original git-commit. Signed-off-by: Christoph Paasch --- net/sched/cls_route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c index 37da567..f17c67f 100644 --- a/net/sched/cls_route.c +++ b/net/sched/cls_route.c @@ -470,7 +470,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb, if (head == NULL) { head = kzalloc(sizeof(struct route4_head), GFP_KERNEL); if (head == NULL) - goto errout; + return err; tcf_tree_lock(tp); tp->root = head;