mctp: fix use after free
Clang static analysis reports this problem
route.c:425:4: warning: Use of memory after it is freed
trace_mctp_key_acquire(key);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
When mctp_key_add() fails, key is freed but then is later
used in trace_mctp_key_acquire(). Add an else statement
to use the key only when mctp_key_add() is successful.
Fixes: 4f9e1ba6de
("mctp: Add tracepoints for tag/key handling")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Родитель
ef57640575
Коммит
7e5b6a5c8c
|
@ -412,13 +412,14 @@ static int mctp_route_input(struct mctp_route *route, struct sk_buff *skb)
|
|||
* this function.
|
||||
*/
|
||||
rc = mctp_key_add(key, msk);
|
||||
if (rc)
|
||||
if (rc) {
|
||||
kfree(key);
|
||||
} else {
|
||||
trace_mctp_key_acquire(key);
|
||||
|
||||
trace_mctp_key_acquire(key);
|
||||
|
||||
/* we don't need to release key->lock on exit */
|
||||
mctp_key_unref(key);
|
||||
/* we don't need to release key->lock on exit */
|
||||
mctp_key_unref(key);
|
||||
}
|
||||
key = NULL;
|
||||
|
||||
} else {
|
||||
|
|
Загрузка…
Ссылка в новой задаче