From 703989eb12185471d6e494105f91470ea74d822d Mon Sep 17 00:00:00 2001 From: Thomas Haller Date: Mon, 24 Nov 2014 17:19:54 +0100 Subject: [PATCH] route: make rtnl_tc_clone() more robust against NLE_NOMEM When oo_clone() fails, the new object is freed. Make sure 'dst' does not own parts of 'src'. Acked-by: Thomas Graf Signed-off-by: Thomas Haller --- lib/route/tc.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/lib/route/tc.c b/lib/route/tc.c index 4c92822..1dcb986 100644 --- a/lib/route/tc.c +++ b/lib/route/tc.c @@ -760,16 +760,24 @@ int rtnl_tc_clone(struct nl_object *dstobj, struct nl_object *srcobj) dst->tc_link = src->tc_link; } + dst->tc_opts = NULL; + dst->tc_xstats = NULL; + dst->tc_subdata = NULL; + dst->ce_mask &= ~(TCA_ATTR_OPTS | + TCA_ATTR_XSTATS); + if (src->tc_opts) { dst->tc_opts = nl_data_clone(src->tc_opts); if (!dst->tc_opts) return -NLE_NOMEM; + dst->ce_mask |= TCA_ATTR_OPTS; } - + if (src->tc_xstats) { dst->tc_xstats = nl_data_clone(src->tc_xstats); if (!dst->tc_xstats) return -NLE_NOMEM; + dst->ce_mask |= TCA_ATTR_XSTATS; } if (src->tc_subdata) { -- 2.40.0