* [PATCH net-next] bpf, lpm: fix kfree of im_node in trie_update_elem
@ 2017-01-24 0:26 Daniel Borkmann
2017-01-24 0:37 ` Alexei Starovoitov
2017-01-24 2:18 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Daniel Borkmann @ 2017-01-24 0:26 UTC (permalink / raw)
To: davem; +Cc: ast, daniel, netdev, Daniel Borkmann
We need to initialize im_node to NULL, otherwise in case of error path
it gets passed to kfree() as uninitialized pointer.
Fixes: b95a5c4db09b ("bpf: add a longest prefix match trie map implementation")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
---
Mentioned it in http://patchwork.ozlabs.org/patch/718070/, but
was probably overlooked.
kernel/bpf/lpm_trie.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c
index ba19241d..144e976 100644
--- a/kernel/bpf/lpm_trie.c
+++ b/kernel/bpf/lpm_trie.c
@@ -262,7 +262,7 @@ static int trie_update_elem(struct bpf_map *map,
void *_key, void *value, u64 flags)
{
struct lpm_trie *trie = container_of(map, struct lpm_trie, map);
- struct lpm_trie_node *node, *im_node, *new_node = NULL;
+ struct lpm_trie_node *node, *im_node = NULL, *new_node = NULL;
struct lpm_trie_node __rcu **slot;
struct bpf_lpm_trie_key *key = _key;
unsigned long irq_flags;
--
1.9.3
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net-next] bpf, lpm: fix kfree of im_node in trie_update_elem
2017-01-24 0:26 [PATCH net-next] bpf, lpm: fix kfree of im_node in trie_update_elem Daniel Borkmann
@ 2017-01-24 0:37 ` Alexei Starovoitov
2017-01-24 2:18 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Alexei Starovoitov @ 2017-01-24 0:37 UTC (permalink / raw)
To: Daniel Borkmann; +Cc: davem, ast, daniel, netdev
On Tue, Jan 24, 2017 at 01:26:46AM +0100, Daniel Borkmann wrote:
> We need to initialize im_node to NULL, otherwise in case of error path
> it gets passed to kfree() as uninitialized pointer.
>
> Fixes: b95a5c4db09b ("bpf: add a longest prefix match trie map implementation")
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Great catch.
Acked-by: Alexei Starovoitov <ast@kernel.org>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net-next] bpf, lpm: fix kfree of im_node in trie_update_elem
2017-01-24 0:26 [PATCH net-next] bpf, lpm: fix kfree of im_node in trie_update_elem Daniel Borkmann
2017-01-24 0:37 ` Alexei Starovoitov
@ 2017-01-24 2:18 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2017-01-24 2:18 UTC (permalink / raw)
To: daniel; +Cc: ast, daniel, netdev
From: Daniel Borkmann <daniel@iogearbox.net>
Date: Tue, 24 Jan 2017 01:26:46 +0100
> We need to initialize im_node to NULL, otherwise in case of error path
> it gets passed to kfree() as uninitialized pointer.
>
> Fixes: b95a5c4db09b ("bpf: add a longest prefix match trie map implementation")
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
> ---
> Mentioned it in http://patchwork.ozlabs.org/patch/718070/, but
> was probably overlooked.
Applied, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-01-24 2:18 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-01-24 0:26 [PATCH net-next] bpf, lpm: fix kfree of im_node in trie_update_elem Daniel Borkmann
2017-01-24 0:37 ` Alexei Starovoitov
2017-01-24 2:18 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).