[linux-next] LinuxNextTracking branch, master, updated. next-20140818

batman at open-mesh.org batman at open-mesh.org
Tue Aug 19 00:17:31 CEST 2014

The following commit has been merged in the master branch:
commit e050dbeb0d1e19072d0d656b51f06af1af860f19
Author: Sven Eckelmann <sven at narfation.org>
Date:   Fri Aug 15 10:19:39 2014 +0200

    batman-adv: Fix parameter order of hlist_add_behind
    1d023284c31a4e40a94d5bbcb7dbb7a35ee0bcbc ("list: fix order of arguments for
    hlist_add_after(_rcu)") was incorrectly rebased on top of
    d9124268d84a836f14a6ead54ff9d8eee4c43be5 ("batman-adv: Fix out-of-order
    fragmentation support"). The parameter order change of the rebased patch was
    not re-applied as expected. This causes a memory leak and can cause crashes
    when out-of-order packets are received. hlist_add_behind will try to access the
    uninitalized list pointers of frag_entry_new to find the previous/next entry
    and may modify/read random memory locations.
    Signed-off-by: Sven Eckelmann <sven at narfation.org>
    Cc: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index 52c43f9..fc1835c 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -188,7 +188,7 @@ static bool batadv_frag_insert_packet(struct batadv_orig_node *orig_node,
 	/* Reached the end of the list, so insert after 'frag_entry_last'. */
 	if (likely(frag_entry_last)) {
-		hlist_add_behind(&frag_entry_last->list, &frag_entry_new->list);
+		hlist_add_behind(&frag_entry_new->list, &frag_entry_last->list);
 		chain->size += skb->len - hdr_size;
 		chain->timestamp = jiffies;
 		ret = true;


More information about the linux-merge mailing list