Skip to contentSkip to conversation

sch_atm: null dereference

DISCUSSION Applied Jiri Slaby 2 participants 2 messages Sep 4, 2010 – Sep 12, 2010

Subsystems (3)
Networking Network drivers Traffic control (tc)
lore
Share & tools
lore

Jiri Slaby

author
#0 lore raw

Hi,

stanse found a potential null dereference:
atm_tc_change
-> if (flow)

    -> return -EBUSY;
  -> flow is NULL now
  -> if (classid)
    -> if (!list_empty(&flow->list))

Introduced probably in
sch_atm: Convert to use standard list_head facilities.

Could you fix that?

regards,

Signature · 1 line
js
maintainer Applied
#1 lore raw

From: Jiri Slaby <[email protected]>
Date: Sat, 04 Sep 2010 14:37:52 +0200

Quoted 8 lines

stanse found a potential null dereference:
atm_tc_change
-> if (flow)

    -> return -EBUSY;
  -> flow is NULL now
  -> if (classid)
    -> if (!list_empty(&flow->list))
Quoted 4 lines

Introduced probably in
sch_atm: Convert to use standard list_head facilities.

Could you fix that?

Technically it's an unnecessary test that's been there forever.

I've applied the following to net-2.6, thanks!

--------------------
sch_atm: Fix potential NULL deref.

The list_head conversion unearther an unnecessary flow check. Since flow is always NULL here we don't need to see if a matching flow exists already.

Reported-by Jiri Slaby <[email protected]>
Signed-off-by David S. Miller <[email protected]>
---
 net/sched/sch_atm.c |    4 ----
 1 files changed, 0 insertions(+), 4 deletions(-)
net/sched/sch_atm.c +0 -4
index 3406627..6318e11 100644
@@ -255,10 +255,6 @@ static int atm_tc_change(struct Qdisc *sch, u32 classid, u32 parent,
 			error = -EINVAL;
 			goto err_out;
 		}
-		if (!list_empty(&flow->list)) {
-			error = -EEXIST;
-			goto err_out;
-		}
 	} else {
 		int i;
 		unsigned long cl;
Signature · 1 line
1.7.2.2