提交 2b391ee2 编写于 作者: D Daniel Borkmann 提交者: David S. Miller

team: fix releasing uninitialized pointer to BPF prog

Commit 34c5bd66 introduced the possibility that an
uninitialized pointer on the stack (orig_fp) can call into
sk_unattached_filter_destroy() when its value is non NULL.

Before that commit orig_fp was only destroyed in the same
block where it was assigned a valid BPF prog before. Fix it
up by initializing it to NULL.

Fixes: 34c5bd66 ("net: filter: don't release unattached filter through call_rcu()")
Signed-off-by: NDaniel Borkmann <dborkman@redhat.com>
Cc: Pablo Neira <pablo@netfilter.org>
Cc: Alexei Starovoitov <ast@plumgrid.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 ccda4a77
...@@ -272,7 +272,7 @@ static int lb_bpf_func_set(struct team *team, struct team_gsetter_ctx *ctx) ...@@ -272,7 +272,7 @@ static int lb_bpf_func_set(struct team *team, struct team_gsetter_ctx *ctx)
{ {
struct lb_priv *lb_priv = get_lb_priv(team); struct lb_priv *lb_priv = get_lb_priv(team);
struct sk_filter *fp = NULL; struct sk_filter *fp = NULL;
struct sk_filter *orig_fp; struct sk_filter *orig_fp = NULL;
struct sock_fprog_kern *fprog = NULL; struct sock_fprog_kern *fprog = NULL;
int err; int err;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册