netdev - Re: [net-next 1/4] tipc: replace name table service range array with rb tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20180329.144642.751836841871954960.davem@davemloft.net>
Date:   Thu, 29 Mar 2018 14:46:42 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     jon.maloy@...csson.com
Cc:     netdev@...r.kernel.org,
        mohan.krishna.ghanta.krishnamurthy@...csson.com,
        tung.q.nguyen@...tech.com.au, hoang.h.le@...tech.com.au,
        canh.d.luu@...tech.com.au, ying.xue@...driver.com,
        tipc-discussion@...ts.sourceforge.net
Subject: Re: [net-next 1/4] tipc: replace name table service range array
 with rb tree

From: Jon Maloy <jon.maloy@...csson.com>
Date: Wed, 28 Mar 2018 16:58:20 +0200

> -/*
> - * tipc_nametbl_publish - add name publication to network name tables
> +/* tipc_nametbl_publish - add service binding to name table
>   */
>  struct publication *tipc_nametbl_publish(struct net *net, u32 type, u32 lower,
> -					 u32 upper, u32 scope, u32 port_ref,
> +					 u32 upper, u32 scope, u32 port,
>  					 u32 key)
>  {
> -	struct publication *publ;
> -	struct sk_buff *buf = NULL;
> -	struct tipc_net *tn = net_generic(net, tipc_net_id);
> +	struct name_table *nt = tipc_name_table(net);
> +	struct tipc_net *tn = tipc_net(net);
> +	struct sk_buff *skb = NULL;
> +	struct publication *p;
>  
>  	spin_lock_bh(&tn->nametbl_lock);
> -	if (tn->nametbl->local_publ_count >= TIPC_MAX_PUBLICATIONS) {
> -		pr_warn("Publication failed, local publication limit reached (%u)\n",
> -			TIPC_MAX_PUBLICATIONS);
> -		spin_unlock_bh(&tn->nametbl_lock);
> -		return NULL;
> +
> +	if (nt->local_publ_count >= TIPC_MAX_PUBL) {
> +		pr_warn("Bind failed, max limit %u reached\n", TIPC_MAX_PUBL);
> +		goto exit;

If we goto exit:...

> +exit:
>  	spin_unlock_bh(&tn->nametbl_lock);
>  
> -	if (buf)
> -		tipc_node_broadcast(net, buf);
> -	return publ;
> +	if (skb)
> +		tipc_node_broadcast(net, skb);
> +	return p;
>  }

'p' is uninitialized, yet we return it.