[linux-next] LinuxNextTracking branch, master, updated. next-20130202

batman at open-mesh.org batman at open-mesh.org
Sun Feb 3 00:21:41 CET 2013

The following commit has been merged in the master branch:
commit 0d15becee56fdfc2e9a4374c46ea7cf7562a6f32
Author: Matthias Schiffer <mschiffer at universe-factory.net>
Date:   Wed Jan 23 18:11:53 2013 +0100

    batman-adv: fix skb leak in batadv_dat_snoop_incoming_arp_reply()
    The callers of batadv_dat_snoop_incoming_arp_reply() assume the skb has been
    freed when it returns true; fix this by calling kfree_skb before returning as
    it is done in batadv_dat_snoop_incoming_arp_request().
    Signed-off-by: Matthias Schiffer <mschiffer at universe-factory.net>
    Signed-off-by: Marek Lindner <lindner_marek at yahoo.de>
    Acked-by: Antonio Quartulli <ordex at autistici.org>
    Signed-off-by: Antonio Quartulli <ordex at autistici.org>

diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index 8e1d89d..ce0d299 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -1012,6 +1012,8 @@ bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,
 	ret = !batadv_is_my_client(bat_priv, hw_dst);
+	if (ret)
+		kfree_skb(skb);
 	/* if ret == false -> packet has to be delivered to the interface */
 	return ret;


More information about the linux-merge mailing list