diff mbox

sch_atm: null dereference

Message ID 20100912.115743.226782545.davem@davemloft.net
State Accepted, archived
Delegated to: David Miller
Headers show

Commit Message

David Miller Sept. 12, 2010, 6:57 p.m. UTC 
From: Jiri Slaby <jirislaby@gmail.com>
Date: Sat, 04 Sep 2010 14:37:52 +0200

> stanse found a potential null dereference:
> atm_tc_change
>   -> if (flow)
>     -> return -EBUSY;
>   -> flow is NULL now
>   -> if (classid)
>     -> if (!list_empty(&flow->list))
> 
> Introduced probably in
>     sch_atm: Convert to use standard list_head facilities.
> 
> Could you fix that?

Technically it's an unnecessary test that's been there forever.

I've applied the following to net-2.6, thanks!

--------------------
sch_atm: Fix potential NULL deref.

The list_head conversion unearther an unnecessary flow
check.  Since flow is always NULL here we don't need to
see if a matching flow exists already.

Reported-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
 net/sched/sch_atm.c |    4 ----
 1 files changed, 0 insertions(+), 4 deletions(-)
diff mbox

Patch

diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 3406627..6318e11 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -255,10 +255,6 @@  static int atm_tc_change(struct Qdisc *sch, u32 classid, u32 parent,
 			error = -EINVAL;
 			goto err_out;
 		}
-		if (!list_empty(&flow->list)) {
-			error = -EEXIST;
-			goto err_out;
-		}
 	} else {
 		int i;
 		unsigned long cl;