[linux-next] LinuxNextTracking branch, master, updated. next-20160520

batman at open-mesh.org batman at open-mesh.org
Sat May 21 00:15:45 CEST 2016


The following commit has been merged in the master branch:
commit f7dcdf5fdbe8fec7670d8f65a5db595c98e0ecab
Author: Sven Eckelmann <sven at narfation.org>
Date:   Mon Feb 22 22:56:33 2016 +0100

    batman-adv: Fix unexpected free of bcast_own on add_if error
    
    The function batadv_iv_ogm_orig_add_if allocates new buffers for bcast_own
    and bcast_own_sum. It is expected that these buffers are unchanged in case
    either bcast_own or bcast_own_sum couldn't be resized.
    
    But the error handling of this function frees the already resized buffer
    for bcast_own when the allocation of the new bcast_own_sum buffer failed.
    This will lead to an invalid memory access when some code will try to
    access bcast_own.
    
    Instead the resized new bcast_own buffer has to be kept. This will not lead
    to problems because the size of the buffer was only increased and therefore
    no user of the buffer will try to access bytes outside of the new buffer.
    
    Fixes: d0015fdd3d2c ("batman-adv: provide orig_node routing API")
    Signed-off-by: Sven Eckelmann <sven at narfation.org>
    Signed-off-by: Marek Lindner <mareklindner at neomailbox.ch>
    Signed-off-by: Antonio Quartulli <a at unstable.cc>

diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 7f98a9d..1b5bbaf 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -157,10 +157,8 @@ static int batadv_iv_ogm_orig_add_if(struct batadv_orig_node *orig_node,
 	orig_node->bat_iv.bcast_own = data_ptr;
 
 	data_ptr = kmalloc_array(max_if_num, sizeof(u8), GFP_ATOMIC);
-	if (!data_ptr) {
-		kfree(orig_node->bat_iv.bcast_own);
+	if (!data_ptr)
 		goto unlock;
-	}
 
 	memcpy(data_ptr, orig_node->bat_iv.bcast_own_sum,
 	       (max_if_num - 1) * sizeof(u8));

-- 
LinuxNextTracking


More information about the linux-merge mailing list