[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20100912.115743.226782545.davem@davemloft.net>
Date: Sun, 12 Sep 2010 11:57:43 -0700 (PDT)
From: David Miller <davem@...emloft.net>
To: jirislaby@...il.com
Cc: netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: sch_atm: null dereference
From: Jiri Slaby <jirislaby@...il.com>
Date: Sat, 04 Sep 2010 14:37:52 +0200
> stanse found a potential null dereference:
> atm_tc_change
> -> if (flow)
> -> return -EBUSY;
> -> flow is NULL now
> -> if (classid)
> -> if (!list_empty(&flow->list))
>
> Introduced probably in
> sch_atm: Convert to use standard list_head facilities.
>
> Could you fix that?
Technically it's an unnecessary test that's been there forever.
I've applied the following to net-2.6, thanks!
--------------------
sch_atm: Fix potential NULL deref.
The list_head conversion unearther an unnecessary flow
check. Since flow is always NULL here we don't need to
see if a matching flow exists already.
Reported-by: Jiri Slaby <jirislaby@...il.com>
Signed-off-by: David S. Miller <davem@...emloft.net>
---
net/sched/sch_atm.c | 4 ----
1 files changed, 0 insertions(+), 4 deletions(-)
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 3406627..6318e11 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -255,10 +255,6 @@ static int atm_tc_change(struct Qdisc *sch, u32 classid, u32 parent,
error = -EINVAL;
goto err_out;
}
- if (!list_empty(&flow->list)) {
- error = -EEXIST;
- goto err_out;
- }
} else {
int i;
unsigned long cl;
--
1.7.2.2
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists