[linux-next] LinuxNextTracking branch, master, updated. next-20180921

batman at open-mesh.org batman at open-mesh.org
Sat Sep 22 00:20:36 CEST 2018

The following commit has been merged in the master branch:
commit b9fd14c20871e6189f635e49b32d7789e430b3c8
Author: Sven Eckelmann <sven at narfation.org>
Date:   Fri Aug 31 16:46:47 2018 +0200

    batman-adv: Fix segfault when writing to throughput_override
    The per hardif sysfs file "batman_adv/throughput_override" prints the
    resulting change as info text when the users writes to this file. It uses
    the helper function batadv_info to add it at the same time to the kernel
    ring buffer and to the batman-adv debug log (when CONFIG_BATMAN_ADV_DEBUG
    is enabled).
    The function batadv_info requires as first parameter the batman-adv softif
    net_device. This parameter is then used to find the private buffer which
    contains the debug log for this batman-adv interface. But
    batadv_store_throughput_override used as first argument the slave
    net_device. This slave device doesn't have the batadv_priv private data
    which is access by batadv_info.
    Writing to this file with CONFIG_BATMAN_ADV_DEBUG enabled can either lead
    to a segfault or to memory corruption.
    Fixes: 0b5ecc6811bd ("batman-adv: add throughput override attribute to hard_ifaces")
    Signed-off-by: Sven Eckelmann <sven at narfation.org>
    Acked-by: Marek Lindner <mareklindner at neomailbox.ch>
    Signed-off-by: Simon Wunderlich <sw at simonwunderlich.de>

diff --git a/net/batman-adv/sysfs.c b/net/batman-adv/sysfs.c
index f2eef43bd2ec..3a76e8970c02 100644
--- a/net/batman-adv/sysfs.c
+++ b/net/batman-adv/sysfs.c
@@ -1090,8 +1090,9 @@ static ssize_t batadv_store_throughput_override(struct kobject *kobj,
 	if (old_tp_override == tp_override)
 		goto out;
-	batadv_info(net_dev, "%s: Changing from: %u.%u MBit to: %u.%u MBit\n",
-		    "throughput_override",
+	batadv_info(hard_iface->soft_iface,
+		    "%s: %s: Changing from: %u.%u MBit to: %u.%u MBit\n",
+		    "throughput_override", net_dev->name,
 		    old_tp_override / 10, old_tp_override % 10,
 		    tp_override / 10, tp_override % 10);


More information about the linux-merge mailing list