Hello Antonio Quartulli,
The patch 7ea7b4a14275: "batman-adv: make the TT CRC logic VLAN
specific" from Jul 30, 2013, leads to the following static checker
warning:
net/batman-adv/translation-table.c:3294 batadv_send_my_tt_response()
error: uninitialized symbol 'tt_change'.
net/batman-adv/translation-table.c
3282 if (!full_table) {
3283 spin_lock_bh(&bat_priv->tt.last_changeset_lock);
3284
3285 tt_len = bat_priv->tt.last_changeset_len;
3286 tvlv_len = batadv_tt_prepare_tvlv_local_data(bat_priv,
3287 &tvlv_tt_data,
3288 &tt_change,
3289 &tt_len);
3290 if (!tt_len)
3291 goto unlock;
This should probably be changed to:
if (!tt_len || !tvlv_len)
goto unlock;
There seems to be an assumption that "tt_len" is set to zero on the
error path? That's another way to fix this, I suppose.
3292
3293 /* Copy the last orig_node's OGM buffer */
3294 memcpy(tt_change, bat_priv->tt.last_changeset,
3295 bat_priv->tt.last_changeset_len);
3296 spin_unlock_bh(&bat_priv->tt.last_changeset_lock);
3297 } else {
See also:
net/batman-adv/translation-table.c:3313 batadv_send_my_tt_response()
error: uninitialized symbol 'tt_change'.
regards,
dan carpenter
Hi David,
here is another bugfix which we would like to see integrated into net,
if this is possible now.
Please pull or let me know of any problem!
Thank you,
Simon
The following changes since commit e13258f38e927b61cdb5f4ad25309450d3b127d1:
batman-adv: Detect missing primaryif during tp_send as error (2016-11-04 12:27:39 +0100)
are available in the git repository at:
git://git.open-mesh.org/linux-merge.git tags/batadv-net-for-davem-20161202
for you to fetch changes up to c2d0f48a13e53b4747704c9e692f5e765e52041a:
batman-adv: Check for alloc errors when preparing TT local data (2016-12-02 10:46:59 +0100)
----------------------------------------------------------------
Here is another batman-adv bugfix:
- fix checking for failed allocation of TVLV blocks in TT local data,
by Sven Eckelmann
----------------------------------------------------------------
Sven Eckelmann (1):
batman-adv: Check for alloc errors when preparing TT local data
net/batman-adv/translation-table.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
batadv_tt_prepare_tvlv_local_data can fail to allocate the memory for the
new TVLV block. The caller is informed about this problem with the returned
length of 0. Not checking this value results in an invalid memory access
when either tt_data or tt_change is accessed.
Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com>
Fixes: 21a57f6e7a3b ("batman-adv: make the TT CRC logic VLAN specific")
Signed-off-by: Sven Eckelmann <sven(a)narfation.org>
---
The very good report from Dan Carpenter can be found at
https://lists.open-mesh.org/pipermail/b.a.t.m.a.n/2016-November/016713.html
net/batman-adv/translation-table.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 7f66309..0dc85eb 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -3282,7 +3282,7 @@ static bool batadv_send_my_tt_response(struct batadv_priv *bat_priv,
&tvlv_tt_data,
&tt_change,
&tt_len);
- if (!tt_len)
+ if (!tt_len || !tvlv_len)
goto unlock;
/* Copy the last orig_node's OGM buffer */
@@ -3300,7 +3300,7 @@ static bool batadv_send_my_tt_response(struct batadv_priv *bat_priv,
&tvlv_tt_data,
&tt_change,
&tt_len);
- if (!tt_len)
+ if (!tt_len || !tvlv_len)
goto out;
/* fill the rest of the tvlv with the real TT entries */
--
2.10.2