* sch_atm: null dereference
@ 2010-09-04 12:37 Jiri Slaby
2010-09-12 18:57 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Jiri Slaby @ 2010-09-04 12:37 UTC (permalink / raw)
To: David S. Miller; +Cc: ML netdev, LKML
Hi,
stanse found a potential null dereference:
atm_tc_change
-> if (flow)
-> return -EBUSY;
-> flow is NULL now
-> if (classid)
-> if (!list_empty(&flow->list))
Introduced probably in
sch_atm: Convert to use standard list_head facilities.
Could you fix that?
regards,
--
js
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: sch_atm: null dereference
2010-09-04 12:37 sch_atm: null dereference Jiri Slaby
@ 2010-09-12 18:57 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2010-09-12 18:57 UTC (permalink / raw)
To: jirislaby; +Cc: netdev, linux-kernel
From: Jiri Slaby <jirislaby@gmail.com>
Date: Sat, 04 Sep 2010 14:37:52 +0200
> stanse found a potential null dereference:
> atm_tc_change
> -> if (flow)
> -> return -EBUSY;
> -> flow is NULL now
> -> if (classid)
> -> if (!list_empty(&flow->list))
>
> Introduced probably in
> sch_atm: Convert to use standard list_head facilities.
>
> Could you fix that?
Technically it's an unnecessary test that's been there forever.
I've applied the following to net-2.6, thanks!
--------------------
sch_atm: Fix potential NULL deref.
The list_head conversion unearther an unnecessary flow
check. Since flow is always NULL here we don't need to
see if a matching flow exists already.
Reported-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
net/sched/sch_atm.c | 4 ----
1 files changed, 0 insertions(+), 4 deletions(-)
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 3406627..6318e11 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -255,10 +255,6 @@ static int atm_tc_change(struct Qdisc *sch, u32 classid, u32 parent,
error = -EINVAL;
goto err_out;
}
- if (!list_empty(&flow->list)) {
- error = -EEXIST;
- goto err_out;
- }
} else {
int i;
unsigned long cl;
--
1.7.2.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2010-09-12 18:57 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-09-04 12:37 sch_atm: null dereference Jiri Slaby
2010-09-12 18:57 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.