Skip to contentSkip to conversation

xfrm: Fix possible error pointer dereference

PATCH In review Steffen Klassert 2 participants 3 messages Jul 3, 2008

Subsystems (3)
Networking Network drivers Networking IPsec
lore
Share & tools
lore

Steffen Klassert

author maintainer
#0 lore raw

PATCH 1/1 xfrm: Fix possible error pointer dereference

Check for error befor dereferencing xdst in xfrm_bundle_create.

Signed-off-by Steffen Klassert <[email protected]>
---
 net/xfrm/xfrm_policy.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)
net/xfrm/xfrm_policy.c +3 -1
index cae9fd8..9fab591 100644
@@ -1384,6 +1384,7 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
 	struct net_device *dev;
 	struct dst_entry *dst_prev = NULL;
 	struct dst_entry *dst0 = NULL;
+	struct dst_entry *dst1 = NULL;
 	int i = 0;
 	int err;
 	int header_len = 0;

@@ -1404,7 +1405,6 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
 
 	for (; i < nx; i++) {
 		struct xfrm_dst *xdst = xfrm_alloc_dst(family);
-		struct dst_entry *dst1 = &xdst->u.dst;
 
 		err = PTR_ERR(xdst);
 		if (IS_ERR(xdst)) {

@@ -1412,6 +1412,8 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
 			goto put_states;
 		}
 
+		dst1 = &xdst->u.dst;
+
 		if (!dst_prev)
 			dst0 = dst1;
 		else {
Signature · 1 line
1.5.3
maintainer
#1 lore raw
Quoted 20 lines · Steffen Klassert

Check for error befor dereferencing xdst in xfrm_bundle_create.

Signed-off-by Steffen Klassert <[email protected]>
---
 net/xfrm/xfrm_policy.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)
net/xfrm/xfrm_policy.c +1 -0
index cae9fd8..9fab591 100644
@@ -1384,6 +1384,7 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
 	struct net_device *dev;
 	struct dst_entry *dst_prev = NULL;
 	struct dst_entry *dst0 = NULL;
+	struct dst_entry *dst1 = NULL;
 	int i = 0;
 	int err;
 	int header_len = 0;

net/xfrm/xfrm_policy.c static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy, · line 1407

Quoted 4 lines
net/xfrm/xfrm_policy.c +0 -1
@@ -1404,7 +1405,6 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
 
 	for (; i < nx; i++) {
 		struct xfrm_dst *xdst = xfrm_alloc_dst(family);
-		struct dst_entry *dst1 = &xdst->u.dst;

Please check again, we're not dereferencing it here.

Cheers,

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
author maintainer
#2 lore raw
Quoted 3 lines · Herbert Xu

Please check again, we're not dereferencing it here.

Yes, we are just getting a pointer.

Sorry for the noise,

Steffen