Repository : ssh://git@open-mesh.org/batman-adv

On branch : master

commit 183150bf258f27683cad5c0e28c4aa638798023c Author: Simon Wunderlich sw@simonwunderlich.de Date: Thu Dec 26 18:57:01 2013 +0100

batman-adv: fix NULL pointer deref in batadv_find_best_neighbor

If there is no best neighbor, don't dereference the NULL pointer. Try to acquire the neighbor node right in the loop instead. There also was a logic bug, finding the worst instead of the best neighbor.

Introduced by 9bb33b8d88e318c4879d37d06ad28e3e018b9036 ("batman-adv: split tq information in neigh_node struct")

Signed-off-by: Simon Wunderlich sw@simonwunderlich.de Signed-off-by: Marek Lindner mareklindner@neomailbox.ch

183150bf258f27683cad5c0e28c4aa638798023c originator.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/originator.c b/originator.c index 2243003..4a5d027 100644 --- a/originator.c +++ b/originator.c @@ -783,14 +783,19 @@ batadv_find_best_neighbor(struct batadv_priv *bat_priv, struct batadv_algo_ops *bao = bat_priv->bat_algo_ops;

rcu_read_lock(); - hlist_for_each_entry_rcu(neigh, &orig_node->neigh_list, list) - if (!best || - (bao->bat_neigh_cmp(neigh, if_outgoing, - best, if_outgoing) <= 0)) - best = neigh; - - if (!atomic_inc_not_zero(&best->refcount)) - best = NULL; + hlist_for_each_entry_rcu(neigh, &orig_node->neigh_list, list) { + if (best && (bao->bat_neigh_cmp(neigh, if_outgoing, + best, if_outgoing) <= 0)) + continue; + + if (!atomic_inc_not_zero(&neigh->refcount)) + continue; + + if (best) + batadv_neigh_node_free_ref(best); + + best = neigh; + } rcu_read_unlock();

return best;