Commit 5c804bfd authored Dec 05, 2006 by Patrick McHardy Committed by David S. Miller Dec 06, 2006

[NET_SCHED]: cls_fw: fix NULL pointer dereference



When the first fw classifier is initialized, there is a small window
between the ->init() and ->change() calls, during which the classifier
is active but not entirely set up and tp->root is still NULL (->init()
does nothing).

When a packet is queued during this window a NULL pointer dereference
occurs in fw_classify() when trying to dereference head->mask;

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent f216f082

net/sched/cls_fw.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -101,9 +101,10 @@ static int fw_classify(struct sk_buff skb, struct tcf_proto tp,
		struct fw_head head = (struct fw_head)tp->root;
		struct fw_filter *f;
		int r;
		u32 id = skb->mark & head->mask;
		u32 id = skb->mark;

		if (head != NULL) {
		id &= head->mask;
		for (f=head->ht[fw_hash(id)]; f; f=f->next) {
		if (f->id == id) {
		*res = f->res;