dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

net_sched: act: Delete estimator in error path. 

Some action modules free struct tcf_common in their error path
while estimator is still active. This results in est_timer()
dereference freed memory.
Add gen_kill_estimator() in ipt, pedit and simple action.

Signed-off-by: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Hiroaki SHIMODA 2012-08-06 05:45:48 +00:00 committed by David S. Miller
parent 9871f1ad67
commit 47fd92f5a7
3 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
net/sched/act_ipt.c
View File

@ -185,7 +185,12 @@ err3:
err2:
kfree(tname);
err1:
kfree(pc);
if (ret == ACT_P_CREATED) {
if (est)
gen_kill_estimator(&pc->tcfc_bstats,
&pc->tcfc_rate_est);
kfree_rcu(pc, tcfc_rcu);
}
return err;
}

5
net/sched/act_pedit.c
View File

@ -74,7 +74,10 @@ static int tcf_pedit_init(struct nlattr *nla, struct nlattr *est,
p = to_pedit(pc);
keys = kmalloc(ksize, GFP_KERNEL);
if (keys == NULL) {
kfree(pc);
if (est)
gen_kill_estimator(&pc->tcfc_bstats,
&pc->tcfc_rate_est);
kfree_rcu(pc, tcfc_rcu);
return -ENOMEM;
}
ret = ACT_P_CREATED;

5
net/sched/act_simple.c
View File

@ -131,7 +131,10 @@ static int tcf_simp_init(struct nlattr *nla, struct nlattr *est,
d = to_defact(pc);
ret = alloc_defdata(d, defdata);
if (ret < 0) {
kfree(pc);
if (est)
gen_kill_estimator(&pc->tcfc_bstats,
&pc->tcfc_rate_est);
kfree_rcu(pc, tcfc_rcu);
return ret;
}
d->tcf_action = parm->action;