netdev-linux: Always check tc_make_request() for NULL return value.

Bug #3912.

1 files changed, 32 insertions, 3 deletions

diff --git a/lib/netdev-linux.c b/lib/netdev-linux.c
index 1312d4d1f..6fb3f5275 100644
--- a/lib/netdev-linux.c
+++ b/lib/netdev-linux.c
@@ -1369,6 +1369,9 @@ netdev_linux_remove_policing(struct netdev *netdev)
     int error;
 
     tcmsg = tc_make_request(netdev, RTM_DELQDISC, 0, &request);
+    if (!tcmsg) {
+        return ENODEV;
+    }
     tcmsg->tcm_handle = tc_make_handle(0xffff, 0);
     tcmsg->tcm_parent = TC_H_INGRESS;
     nl_msg_put_string(&request, TCA_KIND, "ingress");
@@ -1648,16 +1651,20 @@ netdev_linux_get_queue_stats(const struct netdev *netdev,
     }
 }
 
-static void
+static bool
 start_queue_dump(const struct netdev *netdev, struct nl_dump *dump)
 {
     struct ofpbuf request;
     struct tcmsg *tcmsg;
 
     tcmsg = tc_make_request(netdev, RTM_GETTCLASS, 0, &request);
+    if (!tcmsg) {
+        return false;
+    }
     tcmsg->tcm_parent = 0;
     nl_dump_start(dump, rtnl_sock, &request);
     ofpbuf_uninit(&request);
+    return true;
 }
 
 static int
@@ -1714,7 +1721,9 @@ netdev_linux_dump_queue_stats(const struct netdev *netdev,
     }
 
     last_error = 0;
-    start_queue_dump(netdev, &dump);
+    if (!start_queue_dump(netdev, &dump)) {
+        return ENODEV;
+    }
     while (nl_dump_next(&dump, &msg)) {
         error = netdev_dev->tc->ops->class_dump_stats(netdev, &msg, cb, aux);
         if (error) {
@@ -2268,6 +2277,9 @@ htb_setup_qdisc__(struct netdev *netdev)
 
     tcmsg = tc_make_request(netdev, RTM_NEWQDISC,
                             NLM_F_EXCL | NLM_F_CREATE, &request);
+    if (!tcmsg) {
+        return ENODEV;
+    }
     tcmsg->tcm_handle = tc_make_handle(1, 0);
     tcmsg->tcm_parent = TC_H_ROOT;
 
@@ -2308,6 +2320,9 @@ htb_setup_class__(struct netdev *netdev, unsigned int handle,
     opt.prio = class->priority;
 
     tcmsg = tc_make_request(netdev, RTM_NEWTCLASS, NLM_F_CREATE, &request);
+    if (!tcmsg) {
+        return ENODEV;
+    }
     tcmsg->tcm_handle = handle;
     tcmsg->tcm_parent = parent;
 
@@ -2530,7 +2545,9 @@ htb_tc_load(struct netdev *netdev, struct ofpbuf *nlmsg OVS_UNUSED)
     htb = htb_install__(netdev, hc.max_rate);
 
     /* Get queues. */
-    start_queue_dump(netdev, &dump);
+    if (!start_queue_dump(netdev, &dump)) {
+        return ENODEV;
+    }
     while (nl_dump_next(&dump, &msg)) {
         unsigned int queue_id;
 
@@ -3082,6 +3099,9 @@ tc_query_class(const struct netdev *netdev,
     int error;
 
     tcmsg = tc_make_request(netdev, RTM_GETTCLASS, NLM_F_ECHO, &request);
+    if (!tcmsg) {
+        return ENODEV;
+    }
     tcmsg->tcm_handle = handle;
     tcmsg->tcm_parent = parent;
 
@@ -3105,6 +3125,9 @@ tc_delete_class(const struct netdev *netdev, unsigned int handle)
     int error;
 
     tcmsg = tc_make_request(netdev, RTM_DELTCLASS, 0, &request);
+    if (!tcmsg) {
+        return ENODEV;
+    }
     tcmsg->tcm_handle = handle;
     tcmsg->tcm_parent = 0;
 
@@ -3129,6 +3152,9 @@ tc_del_qdisc(struct netdev *netdev)
     int error;
 
     tcmsg = tc_make_request(netdev, RTM_DELQDISC, 0, &request);
+    if (!tcmsg) {
+        return ENODEV;
+    }
     tcmsg->tcm_handle = tc_make_handle(1, 0);
     tcmsg->tcm_parent = TC_H_ROOT;
 
@@ -3180,6 +3206,9 @@ tc_query_qdisc(const struct netdev *netdev)
      * We could check for Linux 2.6.35+ and use a more straightforward method
      * there. */
     tcmsg = tc_make_request(netdev, RTM_GETQDISC, NLM_F_ECHO, &request);
+    if (!tcmsg) {
+        return ENODEV;
+    }
     tcmsg->tcm_handle = tc_make_handle(1, 0);
     tcmsg->tcm_parent = 0;