lkml.org 
[lkml]   [2010]   [Sep]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
SubjectRe: sch_atm: null dereference
From
From: Jiri Slaby <jirislaby@gmail.com>
Date: Sat, 04 Sep 2010 14:37:52 +0200

> stanse found a potential null dereference:
> atm_tc_change
> -> if (flow)
> -> return -EBUSY;
> -> flow is NULL now
> -> if (classid)
> -> if (!list_empty(&flow->list))
>
> Introduced probably in
> sch_atm: Convert to use standard list_head facilities.
>
> Could you fix that?

Technically it's an unnecessary test that's been there forever.

I've applied the following to net-2.6, thanks!

--------------------
sch_atm: Fix potential NULL deref.

The list_head conversion unearther an unnecessary flow
check. Since flow is always NULL here we don't need to
see if a matching flow exists already.

Reported-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
net/sched/sch_atm.c | 4 ----
1 files changed, 0 insertions(+), 4 deletions(-)

diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 3406627..6318e11 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -255,10 +255,6 @@ static int atm_tc_change(struct Qdisc *sch, u32 classid, u32 parent,
error = -EINVAL;
goto err_out;
}
- if (!list_empty(&flow->list)) {
- error = -EEXIST;
- goto err_out;
- }
} else {
int i;
unsigned long cl;
--
1.7.2.2


\
 
 \ /
  Last update: 2010-09-12 21:01    [W:0.034 / U:2.900 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site