diff options
| author | Jesper Juhl <jesper.juhl@gmail.com> | 2007-08-07 18:10:54 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2007-08-07 18:10:54 -0700 |
| commit | 3af8e31cf57646284b5f77f9d57d2c22fa77485a (patch) | |
| tree | 4c39d509d0c6db9e2bfdbabc8f4be66d3795d308 /net | |
| parent | 864c5a4d37b1f25e3c36dd00a09158eae455a8fd (diff) | |
| download | op-kernel-dev-3af8e31cf57646284b5f77f9d57d2c22fa77485a.zip op-kernel-dev-3af8e31cf57646284b5f77f9d57d2c22fa77485a.tar.gz | |
[NETFILTER]: ipt_recent: avoid a possible NULL pointer deref in recent_seq_open()
If the call to seq_open() returns != 0 then the code calls
kfree(st) but then on the very next line proceeds to
dereference the pointer - not good.
Problem spotted by the Coverity checker.
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv4/netfilter/ipt_recent.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/net/ipv4/netfilter/ipt_recent.c b/net/ipv4/netfilter/ipt_recent.c index 3218043..6d0c0f7 100644 --- a/net/ipv4/netfilter/ipt_recent.c +++ b/net/ipv4/netfilter/ipt_recent.c @@ -387,12 +387,17 @@ static int recent_seq_open(struct inode *inode, struct file *file) st = kzalloc(sizeof(*st), GFP_KERNEL); if (st == NULL) return -ENOMEM; + ret = seq_open(file, &recent_seq_ops); - if (ret) + if (ret) { kfree(st); + goto out; + } + st->table = pde->data; seq = file->private_data; seq->private = st; +out: return ret; } |
