* [patch] ipvs: freeing uninitialized pointer on error
@ 2013-01-25 15:44 Dan Carpenter
2013-01-25 20:56 ` Julian Anastasov
0 siblings, 1 reply; 3+ messages in thread
From: Dan Carpenter @ 2013-01-25 15:44 UTC (permalink / raw)
To: Wensong Zhang
Cc: Simon Horman, Julian Anastasov, Pablo Neira Ayuso,
Patrick McHardy, David S. Miller, netdev, lvs-devel,
netfilter-devel, netfilter, coreteam, kernel-janitors
If state != IP_VS_STATE_BACKUP then tinfo->buf is uninitialized. If
kthread_run() fails then it means we free random memory resulting in an
oops.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index effa10c..44fd10c 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -1795,6 +1795,8 @@ int start_sync_thread(struct net *net, int state, char *mcast_ifn, __u8 syncid)
GFP_KERNEL);
if (!tinfo->buf)
goto outtinfo;
+ } else {
+ tinfo->buf = NULL;
}
tinfo->id = id;
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [patch] ipvs: freeing uninitialized pointer on error
2013-01-25 15:44 [patch] ipvs: freeing uninitialized pointer on error Dan Carpenter
@ 2013-01-25 20:56 ` Julian Anastasov
0 siblings, 0 replies; 3+ messages in thread
From: Julian Anastasov @ 2013-01-25 20:56 UTC (permalink / raw)
To: Dan Carpenter
Cc: Wensong Zhang, Simon Horman, Pablo Neira Ayuso, Patrick McHardy,
David S. Miller, netdev, lvs-devel, netfilter-devel, netfilter,
coreteam, kernel-janitors
Hello,
On Fri, 25 Jan 2013, Dan Carpenter wrote:
> If state != IP_VS_STATE_BACKUP then tinfo->buf is uninitialized. If
> kthread_run() fails then it means we free random memory resulting in an
> oops.
Good catch. Simon, please apply!
Problem is in 3.5+ caused by commit f73181c828
(ipvs: add support for sync threads)
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
> diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
> index effa10c..44fd10c 100644
> --- a/net/netfilter/ipvs/ip_vs_sync.c
> +++ b/net/netfilter/ipvs/ip_vs_sync.c
> @@ -1795,6 +1795,8 @@ int start_sync_thread(struct net *net, int state, char *mcast_ifn, __u8 syncid)
> GFP_KERNEL);
> if (!tinfo->buf)
> goto outtinfo;
> + } else {
> + tinfo->buf = NULL;
> }
> tinfo->id = id;
Regards
--
Julian Anastasov <ja@ssi.bg>
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH] ipvs: freeing uninitialized pointer on error
2013-01-28 1:18 [GIT PULL nf] IPVS Simon Horman
@ 2013-01-28 1:18 ` Simon Horman
0 siblings, 0 replies; 3+ messages in thread
From: Simon Horman @ 2013-01-28 1:18 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: lvs-devel, netdev, netfilter-devel, Wensong Zhang,
Julian Anastasov, Hans Schillstrom, Hans Schillstrom,
Jesper Dangaard Brouer, Dan Carpenter, Simon Horman
From: Dan Carpenter <dan.carpenter@oracle.com>
If state != IP_VS_STATE_BACKUP then tinfo->buf is uninitialized. If
kthread_run() fails then it means we free random memory resulting in an
oops.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
---
net/netfilter/ipvs/ip_vs_sync.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index effa10c..44fd10c 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -1795,6 +1795,8 @@ int start_sync_thread(struct net *net, int state, char *mcast_ifn, __u8 syncid)
GFP_KERNEL);
if (!tinfo->buf)
goto outtinfo;
+ } else {
+ tinfo->buf = NULL;
}
tinfo->id = id;
--
1.7.10.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2013-01-28 1:18 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-01-25 15:44 [patch] ipvs: freeing uninitialized pointer on error Dan Carpenter
2013-01-25 20:56 ` Julian Anastasov
-- strict thread matches above, loose matches on Subject: below --
2013-01-28 1:18 [GIT PULL nf] IPVS Simon Horman
2013-01-28 1:18 ` [PATCH] ipvs: freeing uninitialized pointer on error Simon Horman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).