| Message ID | 20241028080515.3540779-1-ruanjinjie@huawei.com (mailing list archive) |
|---|---|
| State | New |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] netlink: Fix off-by-one error in netlink_proto_init() | expand |
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index 0a9287fadb47..9601b85dda95 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -2936,7 +2936,7 @@ static int __init netlink_proto_init(void) for (i = 0; i < MAX_LINKS; i++) { if (rhashtable_init(&nl_table[i].hash, &netlink_rhashtable_params) < 0) { - while (--i > 0) + while (--i >= 0) rhashtable_destroy(&nl_table[i].hash); kfree(nl_table); goto panic;
In the error path of netlink_proto_init(), frees the already allocated bucket table for new hash tables in a loop, but the loop condition terminates when the index reaches zero, which fails to free the first bucket table at index zero. Check for >= 0 so that nl_table[0].hash is freed as well. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> --- net/netlink/af_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)