[NET_SCHED]: cls_basic: fix NULL pointer dereference
authorPatrick McHardy <kaber@trash.net>
Sun, 25 Mar 2007 05:13:06 +0000 (22:13 -0700)
committerDavid S. Miller <davem@sunset.davemloft.net>
Mon, 26 Mar 2007 01:48:11 +0000 (18:48 -0700)
cls_basic doesn't allocate tp->root before it is linked into the
active classifier list, resulting in a NULL pointer dereference
when packets hit the classifier before its ->change function is
called.

Reported by Chris Madden <chris@reflexsecurity.com>

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/sched/cls_basic.c

index fad08e521c24f91456590ac4cb6988776f80171b..70fe36eb66a2619e038f4f83419f673d1370375c 100644 (file)
@@ -81,6 +81,13 @@ static void basic_put(struct tcf_proto *tp, unsigned long f)
 
 static int basic_init(struct tcf_proto *tp)
 {
+       struct basic_head *head;
+
+       head = kzalloc(sizeof(*head), GFP_KERNEL);
+       if (head == NULL)
+               return -ENOBUFS;
+       INIT_LIST_HEAD(&head->flist);
+       tp->root = head;
        return 0;
 }
 
@@ -176,15 +183,6 @@ static int basic_change(struct tcf_proto *tp, unsigned long base, u32 handle,
        }
 
        err = -ENOBUFS;
-       if (head == NULL) {
-               head = kzalloc(sizeof(*head), GFP_KERNEL);
-               if (head == NULL)
-                       goto errout;
-
-               INIT_LIST_HEAD(&head->flist);
-               tp->root = head;
-       }
-
        f = kzalloc(sizeof(*f), GFP_KERNEL);
        if (f == NULL)
                goto errout;