diff options
| author | Cong Wang <xiyou.wangcong@gmail.com> | 2020-02-04 20:10:12 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2020-02-05 14:11:57 +0100 |
| commit | 52b5ae501c045010aeeb1d5ac0373ff161a88291 (patch) | |
| tree | 701c31838708e8147ed62ee53c15b17df0aad781 /net/sched | |
| parent | mptcp: fix use-after-free on tcp fallback (diff) | |
| download | linux-52b5ae501c045010aeeb1d5ac0373ff161a88291.tar.xz linux-52b5ae501c045010aeeb1d5ac0373ff161a88291.zip | |
net_sched: fix a resource leak in tcindex_set_parms()
Jakub noticed there is a potential resource leak in
tcindex_set_parms(): when tcindex_filter_result_init() fails
and it jumps to 'errout1' which doesn't release the memory
and resources allocated by tcindex_alloc_perfect_hash().
We should just jump to 'errout_alloc' which calls
tcindex_free_perfect_hash().
Fixes: b9a24bb76bf6 ("net_sched: properly handle failure case of tcf_exts_init()")
Reported-by: Jakub Kicinski <kuba@kernel.org>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sched')
| -rw-r--r-- | net/sched/cls_tcindex.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c index 0323aee03de7..09b7dc5fe7e0 100644 --- a/net/sched/cls_tcindex.c +++ b/net/sched/cls_tcindex.c @@ -365,7 +365,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base, err = tcindex_filter_result_init(&new_filter_result, net); if (err < 0) - goto errout1; + goto errout_alloc; if (old_r) cr = r->res; @@ -484,7 +484,6 @@ errout_alloc: tcindex_free_perfect_hash(cp); else if (balloc == 2) kfree(cp->h); -errout1: tcf_exts_destroy(&new_filter_result.exts); errout: kfree(cp); |