lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <20170518140702.6072-1-colin.king@canonical.com> Date: Thu, 18 May 2017 15:07:02 +0100 From: Colin King <colin.king@...onical.com> To: Jamal Hadi Salim <jhs@...atatu.com>, Cong Wang <xiyou.wangcong@...il.com>, Jiri Pirko <jiri@...nulli.us>, "David S . Miller" <davem@...emloft.net>, netdev@...r.kernel.org Cc: kernel-janitors@...r.kernel.org, linux-kernel@...r.kernel.org Subject: [PATCH] net: sched: fix a use-after-free error on chain on the error exit path From: Colin Ian King <colin.king@...onical.com> Set chain to null after the call to tcf_chain_destroy so that we don't call tcf_chain_put on the error exit path, thus avoiding a use-after-free error. Detected by CoverityScan, CID#1436357 ("Use after free") Signed-off-by: Colin Ian King <colin.king@...onical.com> --- net/sched/cls_api.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c index 4020b8d932a1..82ebdc3fcb2e 100644 --- a/net/sched/cls_api.c +++ b/net/sched/cls_api.c @@ -511,6 +511,7 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n, if (n->nlmsg_type == RTM_DELTFILTER && prio == 0) { tfilter_notify_chain(net, skb, n, chain, RTM_DELTFILTER); tcf_chain_destroy(chain); + chain = NULL; err = 0; goto errout; } -- 2.11.0
Powered by blists - more mailing lists