lkml.org 
[lkml]   [2006]   [Aug]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] fix use after free in netlink_kernel_create()
This patch invalidates nl_table by setting NULL when netlink
initialization failed. Otherwise netlink_kernel_create() would
access nl_table which has already been freed.

CC: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Akinobu Mita <mita@miraclelinux.com>

net/netlink/af_netlink.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)

Index: work-failmalloc/net/netlink/af_netlink.c
===================================================================
--- work-failmalloc.orig/net/netlink/af_netlink.c
+++ work-failmalloc/net/netlink/af_netlink.c
@@ -1745,11 +1745,8 @@ static int __init netlink_proto_init(voi
netlink_skb_parms_too_large();

nl_table = kcalloc(MAX_LINKS, sizeof(*nl_table), GFP_KERNEL);
- if (!nl_table) {
-enomem:
- printk(KERN_CRIT "netlink_init: Cannot allocate nl_table\n");
- return -ENOMEM;
- }
+ if (!nl_table)
+ goto enomem;

if (num_physpages >= (128 * 1024))
max = num_physpages >> (21 - PAGE_SHIFT);
@@ -1769,6 +1766,7 @@ enomem:
nl_pid_hash_free(nl_table[i].hash.table,
1 * sizeof(*hash->table));
kfree(nl_table);
+ nl_table = NULL;
goto enomem;
}
memset(hash->table, 0, 1 * sizeof(*hash->table));
@@ -1786,6 +1784,9 @@ enomem:
rtnetlink_init();
out:
return err;
+enomem:
+ printk(KERN_CRIT "netlink_init: Cannot allocate nl_table\n");
+ return -ENOMEM;
}

core_initcall(netlink_proto_init);
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
\
 
 \ /
  Last update: 2006-08-13 12:19    [W:1.215 / U:0.028 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site