From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
"Theodore Ts'o" <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
torvalds@linux-foundation.org, akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Stephen Hemminger <shemminger@vyatta.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [patch 13/38] PKT_SCHED: ematch: oops from uninitialized variable (resend)
Date: Fri, 22 Feb 2008 16:30:23 -0800 [thread overview]
Message-ID: <20080223003023.GN7268@suse.de> (raw)
In-Reply-To: <20080223002907.GA7268@suse.de>
[-- Attachment #1: pkt_sched-ematch-oops-from-uninitialized-variable.patch --]
[-- Type: text/plain, Size: 2432 bytes --]
2.6.24-stable review patch. If anyone has any objections, please let us
know.
------------------
Upstream commit: 268bcca1e7b0d244afd07ea89cda672e61b0fc4a
Setting up a meta match causes a kernel OOPS because of uninitialized
elements in tree.
[ 37.322381] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
[ 37.322381] IP: [<ffffffff883fc717>] :em_meta:em_meta_destroy+0x17/0x80
[ 37.322381] Call Trace:
[ 37.322381] [<ffffffff803ec83d>] tcf_em_tree_destroy+0x2d/0xa0
[ 37.322381] [<ffffffff803ecc8c>] tcf_em_tree_validate+0x2dc/0x4a0
[ 37.322381] [<ffffffff803f06d2>] nla_parse+0x92/0xe0
[ 37.322381] [<ffffffff883f9672>] :cls_basic:basic_change+0x202/0x3c0
[ 37.322381] [<ffffffff802a3917>] kmem_cache_alloc+0x67/0xa0
[ 37.322381] [<ffffffff803ea221>] tc_ctl_tfilter+0x3b1/0x580
[ 37.322381] [<ffffffff803dffd0>] rtnetlink_rcv_msg+0x0/0x260
[ 37.322381] [<ffffffff803ee944>] netlink_rcv_skb+0x74/0xa0
[ 37.322381] [<ffffffff803dffc8>] rtnetlink_rcv+0x18/0x20
[ 37.322381] [<ffffffff803ee6c3>] netlink_unicast+0x263/0x290
[ 37.322381] [<ffffffff803cf276>] __alloc_skb+0x96/0x160
[ 37.322381] [<ffffffff803ef014>] netlink_sendmsg+0x274/0x340
[ 37.322381] [<ffffffff803c7c3b>] sock_sendmsg+0x12b/0x140
[ 37.322381] [<ffffffff8024de90>] autoremove_wake_function+0x0/0x30
[ 37.322381] [<ffffffff8024de90>] autoremove_wake_function+0x0/0x30
[ 37.322381] [<ffffffff803c7c3b>] sock_sendmsg+0x12b/0x140
[ 37.322381] [<ffffffff80288611>] zone_statistics+0xb1/0xc0
[ 37.322381] [<ffffffff803c7e5e>] sys_sendmsg+0x20e/0x360
[ 37.322381] [<ffffffff803c7411>] sockfd_lookup_light+0x41/0x80
[ 37.322381] [<ffffffff8028d04b>] handle_mm_fault+0x3eb/0x7f0
[ 37.322381] [<ffffffff8020c2fb>] system_call_after_swapgs+0x7b/0x80
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/sched/ematch.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/net/sched/ematch.c
+++ b/net/sched/ematch.c
@@ -305,10 +305,9 @@ int tcf_em_tree_validate(struct tcf_prot
struct tcf_ematch_tree_hdr *tree_hdr;
struct tcf_ematch *em;
- if (!rta) {
- memset(tree, 0, sizeof(*tree));
+ memset(tree, 0, sizeof(*tree));
+ if (!rta)
return 0;
- }
if (rtattr_parse_nested(tb, TCA_EMATCH_TREE_MAX, rta) < 0)
goto errout;
--
next prev parent reply other threads:[~2008-02-23 0:39 UTC|newest]
Thread overview: 51+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20080223001946.979768610@mini.kroah.org>
2008-02-23 0:29 ` [patch 00/38] 2.6.24-stable review Greg KH
2008-02-23 0:29 ` [patch 01/38] SPARC/SPARC64: Fix usage of .section .sched.text in assembler code Greg KH
2008-02-23 0:29 ` [patch 02/38] NETFILTER: nf_conntrack_tcp: conntrack reopening fix Greg KH
2008-02-23 0:29 ` [patch 03/38] NFS: Fix a potential file corruption issue when writing Greg KH
2008-02-23 0:29 ` [patch 04/38] inotify: fix check for one-shot watches before destroying them Greg KH
2008-02-23 0:29 ` [patch 05/38] hugetlb: add locking for overcommit sysctl Greg KH
2008-02-23 0:29 ` [patch 06/38] quota: turn quotas off when remounting read-only Greg KH
2008-02-25 21:57 ` Jan Kara
2008-02-25 23:56 ` Greg KH
2008-02-23 0:29 ` [patch 07/38] XFS: Fix oops in xfs_file_readdir() Greg KH
2008-02-23 0:30 ` [patch 08/38] Fix dl2k constants Greg KH
2008-02-23 0:30 ` [patch 09/38] SCSI: sd: handle bad lba in sense information Greg KH
2008-02-23 0:30 ` [patch 10/38] TCP: Fix a bug in strategy_allowed_congestion_control Greg KH
2008-02-23 0:30 ` [patch 11/38] TC: oops in em_meta Greg KH
2008-02-23 0:30 ` [patch 12/38] SELinux: Fix double free in selinux_netlbl_sock_setsid() Greg KH
2008-02-23 0:30 ` Greg KH [this message]
2008-02-23 0:30 ` [patch 14/38] NET: Add if_addrlabel.h to sanitized headers Greg KH
2008-02-23 0:30 ` [patch 15/38] IPV4: fib_trie: apply fixes from fib_hash Greg KH
2008-02-23 0:30 ` [patch 16/38] IPV4: fib: fix route replacement, fib_info is shared Greg KH
2008-02-23 0:30 ` [patch 17/38] IPCOMP: Fix reception of incompressible packets Greg KH
2008-02-23 0:30 ` [patch 18/38] IPCOMP: Fetch nexthdr before ipch is destroyed Greg KH
2008-02-23 0:30 ` [patch 19/38] INET_DIAG: Fix inet_diag_lock_handler error path Greg KH
2008-02-23 0:30 ` [patch 20/38] INET: Prevent out-of-sync truesize on ip_fragment slow path Greg KH
2008-02-23 0:30 ` [patch 21/38] BLUETOOTH: Add conn add/del workqueues to avoid connection fail Greg KH
2008-02-23 0:30 ` [patch 22/38] AUDIT: Increase skb->truesize in audit_expand Greg KH
2008-02-23 0:30 ` [patch 23/38] Be more robust about bad arguments in get_user_pages() Greg KH
2008-02-23 0:31 ` [patch 24/38] Disable G5 NAP mode during SMU commands on U3 Greg KH
2008-02-23 0:31 ` [patch 25/38] hrtimer: fix *rmtp handling in hrtimer_nanosleep() Greg KH
2008-02-23 0:31 ` [patch 26/38] hrtimer: fix *rmtp/restarts handling in compat_sys_nanosleep() Greg KH
2008-02-23 0:31 ` [patch 27/38] SLUB: Deal with annoying gcc warning on kfree() Greg KH
2008-02-23 0:31 ` [patch 28/38] hrtimer: check relative timeouts for overflow Greg KH
2008-02-23 0:31 ` [patch 29/38] hrtimer: catch expired CLOCK_REALTIME timers early Greg KH
2008-02-23 0:31 ` [patch 30/38] genirq: do not leave interupts enabled on free_irq Greg KH
2008-02-23 0:31 ` [patch 31/38] S390: Fix futex_atomic_cmpxchg_std inline assembly Greg KH
2008-02-23 0:31 ` [patch 32/38] USB: fix pm counter leak in usblp Greg KH
2008-02-23 0:31 ` [patch 33/38] SCSI: gdth: scan for scsi devices Greg KH
2008-02-23 3:02 ` Boaz Harrosh
2008-02-23 3:52 ` [stable] " Greg KH
2008-02-23 4:15 ` James Bottomley
2008-02-23 0:31 ` [patch 34/38] kbuild: allow -fstack-protector to take effect Greg KH
2008-02-23 0:46 ` Arjan van de Ven
2008-02-23 0:53 ` Greg KH
2008-02-23 3:41 ` Sam Ravnborg
2008-02-23 3:53 ` [stable] " Greg KH
2008-02-23 6:29 ` Sam Ravnborg
2008-02-23 0:31 ` [patch 35/38] PCMCIA: Fix station address detection in smc Greg KH
2008-02-23 0:31 ` [patch 36/38] POWERPC: Revert chrp_pci_fixup_vt8231_ata devinit to fix libata on pegasos Greg KH
2008-02-23 0:31 ` [patch 37/38] bonding: fix NULL pointer deref in startup processing Greg KH
2008-02-23 0:31 ` [patch 38/38] x86_64: CPA, fix cache attribute inconsistency bug Greg KH
2008-02-23 16:56 ` [patch 00/38] 2.6.24-stable review Chuck Ebbert
2008-02-24 14:55 ` Uli Luckas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20080223003023.GN7268@suse.de \
--to=gregkh@suse.de \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=cavokz@gmail.com \
--cc=cebbert@redhat.com \
--cc=chuckw@quantumlinux.com \
--cc=davej@redhat.com \
--cc=davem@davemloft.net \
--cc=jmforbes@linuxtx.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mkrufky@linuxtv.org \
--cc=rdunlap@xenotime.net \
--cc=reviews@ml.cw.f00f.org \
--cc=shemminger@vyatta.com \
--cc=stable@kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=tytso@mit.edu \
--cc=zwane@arm.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox