Skip to contentSkip to conversation

ipvs: freeing uninitialized pointer on error

PATCH In review Dan Carpenter 2 participants 2 messages Jan 25, 2013

Subsystems (5)
Networking Network drivers Kernel janitors netfilter +1 more subsystems
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 ipvs: freeing uninitialized pointer on error

If state != IP_VS_STATE_BACKUP then tinfo->buf is uninitialized. If kthread_run() fails then it means we free random memory resulting in an oops.

Signed-off-by Dan Carpenter <[email protected]>
net/netfilter/ipvs/ip_vs_sync.c +2 -0
index effa10c..44fd10c 100644
@@ -1795,6 +1795,8 @@ int start_sync_thread(struct net *net, int state, char *mcast_ifn, __u8 syncid)
 					     GFP_KERNEL);
 			if (!tinfo->buf)
 				goto outtinfo;
+		} else {
+			tinfo->buf = NULL;
 		}
 		tinfo->id = id;
maintainer Acked-by on v1 1/1
#1 lore raw

Hello,

Quoted 3 lines · Dan Carpenter

If state != IP_VS_STATE_BACKUP then tinfo->buf is uninitialized. If kthread_run() fails then it means we free random memory resulting in an oops.

	Good catch. Simon, please apply!

	Problem is in 3.5+ caused by commit f73181c828

(ipvs: add support for sync threads)

Quoted 1 line
Signed-off-by Dan Carpenter <[email protected]>
Acked-by Julian Anastasov <[email protected]>

net/netfilter/ipvs/ip_vs_sync.c int start_sync_thread(struct net *net, int state, char *mcast_ifn, __u8 syncid) · line 1801

Quoted 12 lines
net/netfilter/ipvs/ip_vs_sync.c +2 -0
index effa10c..44fd10c 100644
@@ -1795,6 +1795,8 @@ int start_sync_thread(struct net *net, int state, char *mcast_ifn, __u8 syncid)
 					     GFP_KERNEL);
 			if (!tinfo->buf)
 				goto outtinfo;
+		} else {
+			tinfo->buf = NULL;
 		}
 		tinfo->id = id;

Regards

--
Julian Anastasov <[email protected]>