sch_atm: null dereference

sch_atm: null dereference

[Jiri Slaby]

Hi,

stanse found a potential null dereference:
atm_tc_change
  -> if (flow)
    -> return -EBUSY;
  -> flow is NULL now
  -> if (classid)
    -> if (!list_empty(&flow->list))

Introduced probably in
    sch_atm: Convert to use standard list_head facilities.

Could you fix that?

regards,
-- 
js

Re: sch_atm: null dereference

[David Miller]

From: Jiri Slaby <jirislaby@gmail.com>
Date: Sat, 04 Sep 2010 14:37:52 +0200

> stanse found a potential null dereference:
> atm_tc_change
>   -> if (flow)
>     -> return -EBUSY;
>   -> flow is NULL now
>   -> if (classid)
>     -> if (!list_empty(&flow->list))
> 
> Introduced probably in
>     sch_atm: Convert to use standard list_head facilities.
> 
> Could you fix that?

Technically it's an unnecessary test that's been there forever.

I've applied the following to net-2.6, thanks!

--------------------
sch_atm: Fix potential NULL deref.

The list_head conversion unearther an unnecessary flow
check.  Since flow is always NULL here we don't need to
see if a matching flow exists already.

Reported-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
 net/sched/sch_atm.c |    4 ----
 1 files changed, 0 insertions(+), 4 deletions(-)

diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 3406627..6318e11 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -255,10 +255,6 @@ static int atm_tc_change(struct Qdisc *sch, u32 classid, u32 parent,
 			error = -EINVAL;
 			goto err_out;
 		}
-		if (!list_empty(&flow->list)) {
-			error = -EEXIST;
-			goto err_out;
-		}
 	} else {
 		int i;
 		unsigned long cl;
-- 
1.7.2.2