Hi David,
here is another bugfix which we would like to see integrated into net, if this is possible now.
Please pull or let me know of any problem!
Thank you, Simon
The following changes since commit e13258f38e927b61cdb5f4ad25309450d3b127d1:
batman-adv: Detect missing primaryif during tp_send as error (2016-11-04 12:27:39 +0100)
are available in the git repository at:
git://git.open-mesh.org/linux-merge.git tags/batadv-net-for-davem-20161202
for you to fetch changes up to c2d0f48a13e53b4747704c9e692f5e765e52041a:
batman-adv: Check for alloc errors when preparing TT local data (2016-12-02 10:46:59 +0100)
---------------------------------------------------------------- Here is another batman-adv bugfix:
- fix checking for failed allocation of TVLV blocks in TT local data, by Sven Eckelmann
---------------------------------------------------------------- Sven Eckelmann (1): batman-adv: Check for alloc errors when preparing TT local data
net/batman-adv/translation-table.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
From: Sven Eckelmann sven@narfation.org
batadv_tt_prepare_tvlv_local_data can fail to allocate the memory for the new TVLV block. The caller is informed about this problem with the returned length of 0. Not checking this value results in an invalid memory access when either tt_data or tt_change is accessed.
Reported-by: Dan Carpenter dan.carpenter@oracle.com Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific") Signed-off-by: Sven Eckelmann sven@narfation.org Signed-off-by: Simon Wunderlich sw@simonwunderlich.de --- net/batman-adv/translation-table.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index 7f66309..0dc85eb 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -3282,7 +3282,7 @@ static bool batadv_send_my_tt_response(struct batadv_priv *bat_priv, &tvlv_tt_data, &tt_change, &tt_len); - if (!tt_len) + if (!tt_len || !tvlv_len) goto unlock;
/* Copy the last orig_node's OGM buffer */ @@ -3300,7 +3300,7 @@ static bool batadv_send_my_tt_response(struct batadv_priv *bat_priv, &tvlv_tt_data, &tt_change, &tt_len); - if (!tt_len) + if (!tt_len || !tvlv_len) goto out;
/* fill the rest of the tvlv with the real TT entries */
From: Simon Wunderlich sw@simonwunderlich.de Date: Fri, 2 Dec 2016 17:13:22 +0100
here is another bugfix which we would like to see integrated into net, if this is possible now.
Please pull or let me know of any problem!
Pulled, thanks.
b.a.t.m.a.n@lists.open-mesh.org
-
David Miller -
Simon Wunderlich