From: Alexey Dobriyan Date: Tue, 6 Feb 2007 22:35:25 +0000 (-0800) Subject: [IPV4/IPV6] multicast: Check add_grhead() return value X-Git-Tag: v2.6.21-rc1~83^2~65^2~40 X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cc63f70b8b410eb653449151821f6b8b9af6ca42;p=linux-2.6 [IPV4/IPV6] multicast: Check add_grhead() return value add_grhead() allocates memory with GFP_ATOMIC and in at least two places skb from it passed to skb_put() without checking. Signed-off-by: Alexey Dobriyan Signed-off-by: David S. Miller --- diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index 0017ccb01d..024ae56cab 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -455,6 +455,8 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc, skb = add_grhead(skb, pmc, type, &pgr); first = 0; } + if (!skb) + return NULL; psrc = (__be32 *)skb_put(skb, sizeof(__be32)); *psrc = psf->sf_inaddr; scount++; stotal++; diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index 882cde4b40..e3ec216958 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -1582,6 +1582,8 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc, skb = add_grhead(skb, pmc, type, &pgr); first = 0; } + if (!skb) + return NULL; psrc = (struct in6_addr *)skb_put(skb, sizeof(*psrc)); *psrc = psf->sf_addr; scount++; stotal++;