netdev - Re: [PATCH net] net: sched: Don't free f before it is allocated in route4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 24 Oct 2013 07:54:33 -0700
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Christoph Paasch <christoph.paasch@...il.com>
Cc:	netdev@...r.kernel.org, David Miller <davem@...emloft.net>,
	Jamal Hadi Salim <jhs@...atatu.com>,
	Jing Wang <windsdaemon@...il.com>
Subject: Re: [PATCH net] net: sched: Don't free f before it is allocated in
 route4_change

On Thu, 2013-10-24 at 16:50 +0200, Christoph Paasch wrote:
> f is set to *arg in route4_change at the beginning, which points to a
> route4_filter in the hash-table (gotten through route4_get, called by
> tc_ctl_filter). If the alloc of head fails, we should not goto errout,
> because this will free f and thus freed memory will be referenced by
> the hash-table.
> Only later the pointer f will change to an allocated route4_filter.
> 
> This patch returns err if the allocation of head fails as f has not yet
> been allocated inside route4_change.
> 
> Seems the code has been like this since Linus's original git-commit.
> 
> Signed-off-by: Christoph Paasch <christoph.paasch@...ouvain.be>
> ---
>  net/sched/cls_route.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
> index 37da567..f17c67f 100644
> --- a/net/sched/cls_route.c
> +++ b/net/sched/cls_route.c
> @@ -470,7 +470,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
>  	if (head == NULL) {
>  		head = kzalloc(sizeof(struct route4_head), GFP_KERNEL);
>  		if (head == NULL)
> -			goto errout;
> +			return err;
>  
>  		tcf_tree_lock(tp);
>  		tp->root = head;

I see no bug here, you missed the "goto reinsert;"

Guys, if there are no bugs, could we calm down ?

Thanks !



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html