aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPatrick McHardy <kaber@trash.net>2006-12-05 13:46:13 -0800
committerDavid S. Miller <davem@sunset.davemloft.net>2006-12-06 18:39:07 -0800
commit5c804bfdcca2593422dd6edc2d7db4dba645543c (patch)
treeb8b0993a2855372b037f6bbef2f4b67908b16ce8
parentf216f082b2b37c4943f1e7c393e2786648d48f6f (diff)
[NET_SCHED]: cls_fw: fix NULL pointer dereference
When the first fw classifier is initialized, there is a small window between the ->init() and ->change() calls, during which the classifier is active but not entirely set up and tp->root is still NULL (->init() does nothing). When a packet is queued during this window a NULL pointer dereference occurs in fw_classify() when trying to dereference head->mask; Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/sched/cls_fw.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index f59a2c4aa03..c797d6ada7d 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -101,9 +101,10 @@ static int fw_classify(struct sk_buff *skb, struct tcf_proto *tp,
struct fw_head *head = (struct fw_head*)tp->root;
struct fw_filter *f;
int r;
- u32 id = skb->mark & head->mask;
+ u32 id = skb->mark;
if (head != NULL) {
+ id &= head->mask;
for (f=head->ht[fw_hash(id)]; f; f=f->next) {
if (f->id == id) {
*res = f->res;