From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jesper Juhl Subject: [PATCH][netfilter] Avoid a possible NULL pointer deref in recent_seq_open() Date: Sun, 29 Jul 2007 03:08:45 +0200 Message-ID: <200707290308.45464.jesper.juhl@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: netfilter-devel@lists.netfilter.org, Marc Boucher , Harald Welte , Jesper Juhl , Rusty Russell , James Morris , "David S. Miller" , coreteam@netfilter.org, Jozsef Kadlecsik , Patrick McHardy To: Linux Kernel Mailing List Return-path: Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-devel-bounces@lists.netfilter.org Errors-To: netfilter-devel-bounces@lists.netfilter.org List-Id: netfilter-devel.vger.kernel.org EHLO, There is a small problem in net/ipv4/netfilter/ipt_recent.c::recent_seq_open(). If the call to seq_open() returns != 0 then the code calls kfree(st) but then on the very next line proceeds to dereference the pointer - not good. Problem spotted by the Coverity checker. Proposed patch to deal with it below. Compile tested only. Signed-off-by: Jesper Juhl --- net/ipv4/netfilter/ipt_recent.c | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) diff --git a/net/ipv4/netfilter/ipt_recent.c b/net/ipv4/netfilter/ipt_recent.c index 3218043..6d0c0f7 100644 --- a/net/ipv4/netfilter/ipt_recent.c +++ b/net/ipv4/netfilter/ipt_recent.c @@ -387,12 +387,17 @@ static int recent_seq_open(struct inode *inode, struct file *file) st = kzalloc(sizeof(*st), GFP_KERNEL); if (st == NULL) return -ENOMEM; + ret = seq_open(file, &recent_seq_ops); - if (ret) + if (ret) { kfree(st); + goto out; + } + st->table = pde->data; seq = file->private_data; seq->private = st; +out: return ret; }