]>
Commit | Line | Data |
---|---|---|
a1cd50fd GKH |
1 | From stable-bounces@linux.kernel.org Tue Feb 6 21:59:45 2007 |
2 | From: Alexey Dobriyan <adobriyan@openvz.org> | |
3 | Date: Tue, 06 Feb 2007 21:58:27 -0800 (PST) | |
4 | Subject: Fix allocation failure handling in multicast | |
5 | To: stable@kernel.org | |
6 | Cc: bunk@stusta.de | |
7 | Message-ID: <20070206.215827.124083972.davem@davemloft.net> | |
8 | ||
9 | From: Alexey Dobriyan <adobriyan@openvz.org> | |
10 | ||
11 | [IPV4/IPV6] multicast: Check add_grhead() return value | |
12 | ||
13 | add_grhead() allocates memory with GFP_ATOMIC and in at least two places skb | |
14 | from it passed to skb_put() without checking. | |
15 | ||
16 | Signed-off-by: Alexey Dobriyan <adobriyan@openvz.org> | |
17 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
18 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | |
19 | ||
20 | --- | |
21 | net/ipv4/igmp.c | 2 ++ | |
22 | net/ipv6/mcast.c | 2 ++ | |
23 | 2 files changed, 4 insertions(+) | |
24 | ||
25 | --- linux-2.6.20.1.orig/net/ipv4/igmp.c | |
26 | +++ linux-2.6.20.1/net/ipv4/igmp.c | |
27 | @@ -455,6 +455,8 @@ static struct sk_buff *add_grec(struct s | |
28 | skb = add_grhead(skb, pmc, type, &pgr); | |
29 | first = 0; | |
30 | } | |
31 | + if (!skb) | |
32 | + return NULL; | |
33 | psrc = (__be32 *)skb_put(skb, sizeof(__be32)); | |
34 | *psrc = psf->sf_inaddr; | |
35 | scount++; stotal++; | |
36 | --- linux-2.6.20.1.orig/net/ipv6/mcast.c | |
37 | +++ linux-2.6.20.1/net/ipv6/mcast.c | |
38 | @@ -1582,6 +1582,8 @@ static struct sk_buff *add_grec(struct s | |
39 | skb = add_grhead(skb, pmc, type, &pgr); | |
40 | first = 0; | |
41 | } | |
42 | + if (!skb) | |
43 | + return NULL; | |
44 | psrc = (struct in6_addr *)skb_put(skb, sizeof(*psrc)); | |
45 | *psrc = psf->sf_addr; | |
46 | scount++; stotal++; |