Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Li Qiong <liqiong@nfschina.com>
To:     Jamal Hadi Salim <jhs@mojatatu.com>,
        Cong Wang <xiyou.wangcong@gmail.com>,
        Jiri Pirko <jiri@resnulli.us>,
        "David S . Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>
Cc:     netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
        Yu Zhe <yuzhe@nfschina.com>, Li Qiong <liqiong@nfschina.com>
Subject: [PATCH] net: sched: fix a error path in fw_change()
Date:   Thu,  1 Dec 2022 23:15:32 +0800
Message-Id: <20221201151532.25433-1-liqiong@nfschina.com>
Precedence: bulk

The 'pfp' pointer could be null if can't find the target filter.
Check 'pfp' pointer and fix this error path.

Signed-off-by: Li Qiong <liqiong@nfschina.com>
---
 net/sched/cls_fw.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index a32351da968c..b898e4a81146 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -289,6 +289,12 @@ static int fw_change(struct net *net, struct sk_buff *in_skb,
 			if (pfp == f)
 				break;
 
+		if (!pfp) {
+			tcf_exts_destroy(&fnew->exts);
+			kfree(fnew);
+			return err;
+		}
+
 		RCU_INIT_POINTER(fnew->next, rtnl_dereference(pfp->next));
 		rcu_assign_pointer(*fp, fnew);
 		tcf_unbind_filter(tp, &f->res);
-- 
2.11.0