From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756073AbdEROHR (ORCPT ); Thu, 18 May 2017 10:07:17 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:57510 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755462AbdEROHO (ORCPT ); Thu, 18 May 2017 10:07:14 -0400 From: Colin King To: Jamal Hadi Salim , Cong Wang , Jiri Pirko , "David S . Miller" , netdev@vger.kernel.org Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] net: sched: fix a use-after-free error on chain on the error exit path Date: Thu, 18 May 2017 15:07:02 +0100 Message-Id: <20170518140702.6072-1-colin.king@canonical.com> X-Mailer: git-send-email 2.11.0 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Colin Ian King Set chain to null after the call to tcf_chain_destroy so that we don't call tcf_chain_put on the error exit path, thus avoiding a use-after-free error. Detected by CoverityScan, CID#1436357 ("Use after free") Signed-off-by: Colin Ian King --- net/sched/cls_api.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c index 4020b8d932a1..82ebdc3fcb2e 100644 --- a/net/sched/cls_api.c +++ b/net/sched/cls_api.c @@ -511,6 +511,7 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n, if (n->nlmsg_type == RTM_DELTFILTER && prio == 0) { tfilter_notify_chain(net, skb, n, chain, RTM_DELTFILTER); tcf_chain_destroy(chain); + chain = NULL; err = 0; goto errout; } -- 2.11.0