linux-kernel - Re: sch_atm: null dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20100912.115743.226782545.davem@davemloft.net>
Date:	Sun, 12 Sep 2010 11:57:43 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	jirislaby@...il.com
Cc:	netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: sch_atm: null dereference

From: Jiri Slaby <jirislaby@...il.com>
Date: Sat, 04 Sep 2010 14:37:52 +0200

> stanse found a potential null dereference:
> atm_tc_change
>   -> if (flow)
>     -> return -EBUSY;
>   -> flow is NULL now
>   -> if (classid)
>     -> if (!list_empty(&flow->list))
> 
> Introduced probably in
>     sch_atm: Convert to use standard list_head facilities.
> 
> Could you fix that?

Technically it's an unnecessary test that's been there forever.

I've applied the following to net-2.6, thanks!

--------------------
sch_atm: Fix potential NULL deref.

The list_head conversion unearther an unnecessary flow
check.  Since flow is always NULL here we don't need to
see if a matching flow exists already.

Reported-by: Jiri Slaby <jirislaby@...il.com>
Signed-off-by: David S. Miller <davem@...emloft.net>
---
 net/sched/sch_atm.c |    4 ----
 1 files changed, 0 insertions(+), 4 deletions(-)

diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 3406627..6318e11 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -255,10 +255,6 @@ static int atm_tc_change(struct Qdisc *sch, u32 classid, u32 parent,
 			error = -EINVAL;
 			goto err_out;
 		}
-		if (!list_empty(&flow->list)) {
-			error = -EEXIST;
-			goto err_out;
-		}
 	} else {
 		int i;
 		unsigned long cl;
-- 
1.7.2.2

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/