From: Patrick McHardy Date: Tue, 5 Dec 2006 21:46:13 +0000 (-0800) Subject: [NET_SCHED]: cls_fw: fix NULL pointer dereference X-Git-Tag: v2.6.20-rc1~145^2^2~7^2~21 X-Git-Url: http://pilppa.com/gitweb/?a=commitdiff_plain;h=5c804bfdcca2593422dd6edc2d7db4dba645543c;p=linux-2.6-omap-h63xx.git [NET_SCHED]: cls_fw: fix NULL pointer dereference When the first fw classifier is initialized, there is a small window between the ->init() and ->change() calls, during which the classifier is active but not entirely set up and tp->root is still NULL (->init() does nothing). When a packet is queued during this window a NULL pointer dereference occurs in fw_classify() when trying to dereference head->mask; Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller --- diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c index f59a2c4aa03..c797d6ada7d 100644 --- a/net/sched/cls_fw.c +++ b/net/sched/cls_fw.c @@ -101,9 +101,10 @@ static int fw_classify(struct sk_buff *skb, struct tcf_proto *tp, struct fw_head *head = (struct fw_head*)tp->root; struct fw_filter *f; int r; - u32 id = skb->mark & head->mask; + u32 id = skb->mark; if (head != NULL) { + id &= head->mask; for (f=head->ht[fw_hash(id)]; f; f=f->next) { if (f->id == id) { *res = f->res;