net: ipv6: check return value of rhashtable_init
authorMichelleJin <shjy180909@gmail.com>
Mon, 27 Sep 2021 03:34:56 +0000 (03:34 +0000)
committerDavid S. Miller <davem@davemloft.net>
Tue, 28 Sep 2021 11:59:24 +0000 (12:59 +0100)
When rhashtable_init() fails, it returns -EINVAL.
However, since error return value of rhashtable_init is not checked,
it can cause use of uninitialized pointers.
So, fix unhandled errors of rhashtable_init.

Signed-off-by: MichelleJin <shjy180909@gmail.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv6/ila/ila_xlat.c
net/ipv6/seg6.c
net/ipv6/seg6_hmac.c

index a1ac0e3..47447f0 100644 (file)
@@ -610,7 +610,11 @@ int ila_xlat_init_net(struct net *net)
        if (err)
                return err;
 
-       rhashtable_init(&ilan->xlat.rhash_table, &rht_params);
+       err = rhashtable_init(&ilan->xlat.rhash_table, &rht_params);
+       if (err) {
+               free_bucket_spinlocks(ilan->xlat.locks);
+               return err;
+       }
 
        return 0;
 }
index e412817..65744f2 100644 (file)
@@ -374,7 +374,11 @@ static int __net_init seg6_net_init(struct net *net)
        net->ipv6.seg6_data = sdata;
 
 #ifdef CONFIG_IPV6_SEG6_HMAC
-       seg6_hmac_net_init(net);
+       if (seg6_hmac_net_init(net)) {
+               kfree(sdata);
+               kfree(rcu_dereference_raw(sdata->tun_src));
+               return -ENOMEM;
+       };
 #endif
 
        return 0;
@@ -388,7 +392,7 @@ static void __net_exit seg6_net_exit(struct net *net)
        seg6_hmac_net_exit(net);
 #endif
 
-       kfree(sdata->tun_src);
+       kfree(rcu_dereference_raw(sdata->tun_src));
        kfree(sdata);
 }
 
index 687d95d..29bc4e7 100644 (file)
@@ -405,9 +405,7 @@ int __net_init seg6_hmac_net_init(struct net *net)
 {
        struct seg6_pernet_data *sdata = seg6_pernet(net);
 
-       rhashtable_init(&sdata->hmac_infos, &rht_params);
-
-       return 0;
+       return rhashtable_init(&sdata->hmac_infos, &rht_params);
 }
 EXPORT_SYMBOL(seg6_hmac_net_init);