* [PATCH net] net: sched: Don't free f before it is allocated in route4_change
@ 2013-10-24 14:50 Christoph Paasch
2013-10-24 14:54 ` Eric Dumazet
0 siblings, 1 reply; 5+ messages in thread
From: Christoph Paasch @ 2013-10-24 14:50 UTC (permalink / raw)
To: netdev; +Cc: Eric Dumazet, David Miller, Jamal Hadi Salim, Jing Wang
f is set to *arg in route4_change at the beginning, which points to a
route4_filter in the hash-table (gotten through route4_get, called by
tc_ctl_filter). If the alloc of head fails, we should not goto errout,
because this will free f and thus freed memory will be referenced by
the hash-table.
Only later the pointer f will change to an allocated route4_filter.
This patch returns err if the allocation of head fails as f has not yet
been allocated inside route4_change.
Seems the code has been like this since Linus's original git-commit.
Signed-off-by: Christoph Paasch <christoph.paasch@uclouvain.be>
---
net/sched/cls_route.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index 37da567..f17c67f 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -470,7 +470,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
if (head == NULL) {
head = kzalloc(sizeof(struct route4_head), GFP_KERNEL);
if (head == NULL)
- goto errout;
+ return err;
tcf_tree_lock(tp);
tp->root = head;
--
1.8.3.2
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH net] net: sched: Don't free f before it is allocated in route4_change
2013-10-24 14:50 [PATCH net] net: sched: Don't free f before it is allocated in route4_change Christoph Paasch
@ 2013-10-24 14:54 ` Eric Dumazet
2013-10-24 14:59 ` Christoph Paasch
0 siblings, 1 reply; 5+ messages in thread
From: Eric Dumazet @ 2013-10-24 14:54 UTC (permalink / raw)
To: Christoph Paasch; +Cc: netdev, David Miller, Jamal Hadi Salim, Jing Wang
On Thu, 2013-10-24 at 16:50 +0200, Christoph Paasch wrote:
> f is set to *arg in route4_change at the beginning, which points to a
> route4_filter in the hash-table (gotten through route4_get, called by
> tc_ctl_filter). If the alloc of head fails, we should not goto errout,
> because this will free f and thus freed memory will be referenced by
> the hash-table.
> Only later the pointer f will change to an allocated route4_filter.
>
> This patch returns err if the allocation of head fails as f has not yet
> been allocated inside route4_change.
>
> Seems the code has been like this since Linus's original git-commit.
>
> Signed-off-by: Christoph Paasch <christoph.paasch@uclouvain.be>
> ---
> net/sched/cls_route.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
> index 37da567..f17c67f 100644
> --- a/net/sched/cls_route.c
> +++ b/net/sched/cls_route.c
> @@ -470,7 +470,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
> if (head == NULL) {
> head = kzalloc(sizeof(struct route4_head), GFP_KERNEL);
> if (head == NULL)
> - goto errout;
> + return err;
>
> tcf_tree_lock(tp);
> tp->root = head;
I see no bug here, you missed the "goto reinsert;"
Guys, if there are no bugs, could we calm down ?
Thanks !
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH net] net: sched: Don't free f before it is allocated in route4_change
2013-10-24 14:54 ` Eric Dumazet
@ 2013-10-24 14:59 ` Christoph Paasch
2013-10-24 15:05 ` Eric Dumazet
0 siblings, 1 reply; 5+ messages in thread
From: Christoph Paasch @ 2013-10-24 14:59 UTC (permalink / raw)
To: Eric Dumazet; +Cc: netdev, David Miller, Jamal Hadi Salim, Jing Wang
On 24/10/13 - 07:54:33, Eric Dumazet wrote:
> On Thu, 2013-10-24 at 16:50 +0200, Christoph Paasch wrote:
> > f is set to *arg in route4_change at the beginning, which points to a
> > route4_filter in the hash-table (gotten through route4_get, called by
> > tc_ctl_filter). If the alloc of head fails, we should not goto errout,
> > because this will free f and thus freed memory will be referenced by
> > the hash-table.
> > Only later the pointer f will change to an allocated route4_filter.
> >
> > This patch returns err if the allocation of head fails as f has not yet
> > been allocated inside route4_change.
> >
> > Seems the code has been like this since Linus's original git-commit.
> >
> > Signed-off-by: Christoph Paasch <christoph.paasch@uclouvain.be>
> > ---
> > net/sched/cls_route.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
> > index 37da567..f17c67f 100644
> > --- a/net/sched/cls_route.c
> > +++ b/net/sched/cls_route.c
> > @@ -470,7 +470,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
> > if (head == NULL) {
> > head = kzalloc(sizeof(struct route4_head), GFP_KERNEL);
> > if (head == NULL)
> > - goto errout;
> > + return err;
> >
> > tcf_tree_lock(tp);
> > tp->root = head;
>
> I see no bug here, you missed the "goto reinsert;"
Ups - sorry...
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH net] net: sched: Don't free f before it is allocated in route4_change
2013-10-24 14:59 ` Christoph Paasch
@ 2013-10-24 15:05 ` Eric Dumazet
2013-10-24 15:41 ` Christoph Paasch
0 siblings, 1 reply; 5+ messages in thread
From: Eric Dumazet @ 2013-10-24 15:05 UTC (permalink / raw)
To: Christoph Paasch; +Cc: netdev, David Miller, Jamal Hadi Salim, Jing Wang
On Thu, 2013-10-24 at 16:59 +0200, Christoph Paasch wrote:
> On 24/10/13 - 07:54:33, Eric Dumazet wrote:
> > I see no bug here, you missed the "goto reinsert;"
>
> Ups - sorry...
>
Yeah, trying to find bugs in Alexey code is really tricky ;)
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net] net: sched: Don't free f before it is allocated in route4_change
2013-10-24 15:05 ` Eric Dumazet
@ 2013-10-24 15:41 ` Christoph Paasch
0 siblings, 0 replies; 5+ messages in thread
From: Christoph Paasch @ 2013-10-24 15:41 UTC (permalink / raw)
To: Eric Dumazet; +Cc: netdev, David Miller, Jamal Hadi Salim, Jing Wang
On 24/10/13 - 08:05:57, Eric Dumazet wrote:
> On Thu, 2013-10-24 at 16:59 +0200, Christoph Paasch wrote:
> > On 24/10/13 - 07:54:33, Eric Dumazet wrote:
>
> > > I see no bug here, you missed the "goto reinsert;"
> >
> > Ups - sorry...
> >
>
> Yeah, trying to find bugs in Alexey code is really tricky ;)
Yeah :)
Instead of the goto, a simple if {} else {} would have made it
more readable IMO.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2013-10-24 15:42 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-10-24 14:50 [PATCH net] net: sched: Don't free f before it is allocated in route4_change Christoph Paasch
2013-10-24 14:54 ` Eric Dumazet
2013-10-24 14:59 ` Christoph Paasch
2013-10-24 15:05 ` Eric Dumazet
2013-10-24 15:41 ` Christoph Paasch
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).