* mpls's find_outdev()
@ 2016-04-08 1:41 David Miller
2016-04-08 2:50 ` roopa
0 siblings, 1 reply; 2+ messages in thread
From: David Miller @ 2016-04-08 1:41 UTC (permalink / raw)
To: roopa; +Cc: netdev
While auditing something unrelated, I noticed that this function seems
to potentially dev_put() on an error pointer.
I guess the problem comes from the fact that there are two methods
by which the device pointer is obtained.
First, inet{,6}_fib_lookup_dev() which uses error pointers.
Second, dev_get_by_index() which returns a valid device or NULL,
and therefore does not use error pointers.
If inet{,6}_fib_lookup_dev() returns an error pointer, the !dev check
will not pass and dev_put() will operate on an error pointer and
crash.
If you agree with my analysis, could you please cook up and test a
fix?
Thank you!
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: mpls's find_outdev()
2016-04-08 1:41 mpls's find_outdev() David Miller
@ 2016-04-08 2:50 ` roopa
0 siblings, 0 replies; 2+ messages in thread
From: roopa @ 2016-04-08 2:50 UTC (permalink / raw)
To: David Miller; +Cc: netdev
On 4/7/16, 6:41 PM, David Miller wrote:
> While auditing something unrelated, I noticed that this function seems
> to potentially dev_put() on an error pointer.
>
> I guess the problem comes from the fact that there are two methods
> by which the device pointer is obtained.
>
> First, inet{,6}_fib_lookup_dev() which uses error pointers.
>
> Second, dev_get_by_index() which returns a valid device or NULL,
> and therefore does not use error pointers.
>
> If inet{,6}_fib_lookup_dev() returns an error pointer, the !dev check
> will not pass and dev_put() will operate on an error pointer and
> crash.
>
> If you agree with my analysis, could you please cook up and test a
> fix?
>
> Thank you!
certainly!. I see it. Thanks for catching it.
I will test and post a fix in a few hours.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-04-08 2:50 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-04-08 1:41 mpls's find_outdev() David Miller
2016-04-08 2:50 ` roopa
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox