aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPatrick McHardy <kaber@trash.net>2007-03-26 18:13:51 -0700
committerGreg Kroah-Hartman <gregkh@suse.de>2007-04-06 03:43:13 -0700
commit04301ff6f261dc9230aaf4e2a6a503312dc547bb (patch)
treef7cd392a5751d39cb4ba8160221c80d90bda9b41
parent041172896309634d3a2065d69f3534de9d111ddd (diff)
downloadlinux-linaro-stable-04301ff6f261dc9230aaf4e2a6a503312dc547bb.tar.gz
NET: Fix packet classidier NULL pointer OOPS
[NET_SCHED]: cls_basic: fix NULL pointer dereference cls_basic doesn't allocate tp->root before it is linked into the active classifier list, resulting in a NULL pointer dereference when packets hit the classifier before its ->change function is called. Reported by Chris Madden <chris@reflexsecurity.com> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r--net/sched/cls_basic.c16
1 files changed, 7 insertions, 9 deletions
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index 09fda68c8b39..23e4459beac3 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -82,6 +82,13 @@ static void basic_put(struct tcf_proto *tp, unsigned long f)
static int basic_init(struct tcf_proto *tp)
{
+ struct basic_head *head;
+
+ head = kzalloc(sizeof(*head), GFP_KERNEL);
+ if (head == NULL)
+ return -ENOBUFS;
+ INIT_LIST_HEAD(&head->flist);
+ tp->root = head;
return 0;
}
@@ -177,15 +184,6 @@ static int basic_change(struct tcf_proto *tp, unsigned long base, u32 handle,
}
err = -ENOBUFS;
- if (head == NULL) {
- head = kzalloc(sizeof(*head), GFP_KERNEL);
- if (head == NULL)
- goto errout;
-
- INIT_LIST_HEAD(&head->flist);
- tp->root = head;
- }
-
f = kzalloc(sizeof(*f), GFP_KERNEL);
if (f == NULL)
goto errout;