[linux-next] LinuxNextTracking branch, master, updated. next-20160520

batman at open-mesh.org batman at open-mesh.org
Sat May 21 00:15:45 CEST 2016


The following commit has been merged in the master branch:
commit d285f52cc0f23564fd61976d43fd5b991b4828f6
Author: Sven Eckelmann <sven.eckelmann at open-mesh.com>
Date:   Tue Feb 16 10:47:07 2016 +0100

    batman-adv: Fix integer overflow in batadv_iv_ogm_calc_tq
    
    The undefined behavior sanatizer detected an signed integer overflow in a
    setup with near perfect link quality
    
        UBSAN: Undefined behaviour in net/batman-adv/bat_iv_ogm.c:1246:25
        signed integer overflow:
        8713350 * 255 cannot be represented in type 'int'
    
    The problems happens because the calculation of mixed unsigned and signed
    integers resulted in an integer multiplication.
    
          batadv_ogm_packet::tq (u8 255)
        * tq_own (u8 255)
        * tq_asym_penalty (int 134; max 255)
        * tq_iface_penalty (int 255; max 255)
    
    The tq_iface_penalty, tq_asym_penalty and inv_asym_penalty can just be
    changed to unsigned int because they are not expected to become negative.
    
    Fixes: c039876892e3 ("batman-adv: add WiFi penalty")
    Signed-off-by: Sven Eckelmann <sven.eckelmann at open-mesh.com>
    Signed-off-by: Marek Lindner <mareklindner at neomailbox.ch>
    Signed-off-by: Antonio Quartulli <a at unstable.cc>

diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 1b5bbaf..ce2f203 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -1180,9 +1180,10 @@ static bool batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node,
 	u8 total_count;
 	u8 orig_eq_count, neigh_rq_count, neigh_rq_inv, tq_own;
 	unsigned int neigh_rq_inv_cube, neigh_rq_max_cube;
-	int tq_asym_penalty, inv_asym_penalty, if_num;
+	int if_num;
+	unsigned int tq_asym_penalty, inv_asym_penalty;
 	unsigned int combined_tq;
-	int tq_iface_penalty;
+	unsigned int tq_iface_penalty;
 	bool ret = false;
 
 	/* find corresponding one hop neighbor */

-- 
LinuxNextTracking


More information about the linux-merge mailing list