On Tuesday, 2 January 2024 08:11:47 CET Markus Elfring wrote:

From: Markus Elfring elfring@users.sourceforge.net Date: Tue, 2 Jan 2024 07:27:45 +0100

The kfree() function was called in one case by the batadv_dat_forward_data() function during error handling even if the passed variable contained a null pointer. This issue was detected by using the Coccinelle software.

• Thus return directly after a batadv_dat_select_candidates() call failed at the beginning.

• Delete the label “out” which became unnecessary with this refactoring.

Signed-off-by: Markus Elfring elfring@users.sourceforge.net

Acked-by: Sven Eckelmann sven@narfation.org

---

net/batman-adv/distributed-arp-table.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c index 28a939d56090..4c7e85534324 100644 --- a/net/batman-adv/distributed-arp-table.c +++ b/net/batman-adv/distributed-arp-table.c @@ -684,7 +684,7 @@ static bool batadv_dat_forward_data(struct batadv_priv *bat_priv,

cand = batadv_dat_select_candidates(bat_priv, ip, vid); if (!cand)

• goto out;
  

• return ret;
  
  

  batadv_dbg(BATADV_DBG_DAT, bat_priv, "DHT_SEND for %pI4\n", &ip);

@@ -728,7 +728,6 @@ static bool batadv_dat_forward_data(struct batadv_priv *bat_priv, batadv_orig_node_put(cand[i].orig_node); }

-out: kfree(cand); return ret; } -- 2.43.0

On Tuesday, 2 January 2024 08:12:56 CET Markus Elfring wrote:

From: Markus Elfring elfring@users.sourceforge.net Date: Tue, 2 Jan 2024 07:52:21 +0100

The kfree() function was called in up to three cases by the batadv_throw_uevent() function during error handling even if the passed variable contained a null pointer. This issue was detected by using the Coccinelle software.

• Thus adjust jump targets.

• Reorder kfree() calls at the end.

Signed-off-by: Markus Elfring elfring@users.sourceforge.net

Acked-by: Sven Eckelmann sven@narfation.org

---

net/batman-adv/main.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c index 5fc754b0b3f7..75119f1ffccc 100644 --- a/net/batman-adv/main.c +++ b/net/batman-adv/main.c @@ -691,29 +691,31 @@ int batadv_throw_uevent(struct batadv_priv *bat_priv, enum batadv_uev_type type, "%s%s", BATADV_UEV_TYPE_VAR, batadv_uev_type_str[type]); if (!uevent_env[0])

• goto out;
  

• goto report_error;
  
  

  uevent_env[1] = kasprintf(GFP_ATOMIC, "%s%s", BATADV_UEV_ACTION_VAR, batadv_uev_action_str[action]); if (!uevent_env[1])

• goto out;
  

• goto free_first_env;
  
  

  /* If the event is DEL, ignore the data field */ if (action != BATADV_UEV_DEL) { uevent_env[2] = kasprintf(GFP_ATOMIC, "%s%s", BATADV_UEV_DATA_VAR, data); if (!uevent_env[2])

• 	goto out;
  

• 	goto free_second_env;
  

  }

  ret = kobject_uevent_env(bat_kobj, KOBJ_CHANGE, uevent_env);

-out:

• kfree(uevent_env[0]);
• kfree(uevent_env[1]); kfree(uevent_env[2]);

+free_second_env:

• kfree(uevent_env[1]);

+free_first_env:

• kfree(uevent_env[0]);

  if (ret)

+report_error: batadv_dbg(BATADV_DBG_BATMAN, bat_priv, "Impossible to send uevent for (%s,%s,%s) event (err: %d)\n", batadv_uev_type_str[type], -- 2.43.0