From patchwork Sun Jan 16 02:38:46 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sven Eckelmann X-Patchwork-Id: 678 Return-Path: Received: from v3-1039.vlinux.de (narfation.org [79.140.41.39]) by open-mesh.org (Postfix) with ESMTPS id E4CD71545EF for ; Sun, 16 Jan 2011 03:39:07 +0100 (CET) Received: from sven-desktop.lazhur.ath.cx (i59F6DE8E.versanet.de [89.246.222.142]) by v3-1039.vlinux.de (Postfix) with ESMTPSA id 3289594059; Sun, 16 Jan 2011 03:39:34 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=narfation.org; s=mail; t=1295145574; bh=YjleYZB4aqZVN8g37/T2LYfgK0Wui3w6b1AjIpbknHc=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References; b=WzzH3QYl2rReWy1OT23NydCS3wK/7pOUcssn332S+V7K3wFJsSCoIWkWB+VGferx9 /94hhBk/p46OAkoibIuVAgIobx8OQujp48TWXrqodZbXJ6PqzOPRffrj3FVx8DoHc5 t+TaAiQ5QQQA/EHAWCPujiRFHhxgTZtv2OnNjPuU= From: Sven Eckelmann To: davem@davemloft.net Date: Sun, 16 Jan 2011 03:38:46 +0100 Message-Id: <1295145527-17537-2-git-send-email-sven@narfation.org> X-Mailer: git-send-email 1.7.2.3 In-Reply-To: <1295145527-17537-1-git-send-email-sven@narfation.org> References: <1295145527-17537-1-git-send-email-sven@narfation.org> Cc: netdev@vger.kernel.org, b.a.t.m.a.n@lists.open-mesh.org, Jesper Juhl Subject: [B.A.T.M.A.N.] [PATCH 1/2] batman-adv: Even Batman should not dereference NULL pointers X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.11 Precedence: list Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 16 Jan 2011 02:39:08 -0000 From: Jesper Juhl There's a problem in net/batman-adv/unicast.c::frag_send_skb(). dev_alloc_skb() allocates memory and may fail, thus returning NULL. If this happens we'll pass a NULL pointer on to skb_split() which in turn hands it to skb_split_inside_header() from where it gets passed to skb_put() that lets skb_tail_pointer() play with it and that function dereferences it. And thus the bat dies. While I was at it I also moved the call to dev_alloc_skb() above the assignment to 'unicast_packet' since there's no reason to do that assignment if the memory allocation fails. Signed-off-by: Jesper Juhl Signed-off-by: Sven Eckelmann --- net/batman-adv/unicast.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/net/batman-adv/unicast.c b/net/batman-adv/unicast.c index dc2e28b..ee41fef 100644 --- a/net/batman-adv/unicast.c +++ b/net/batman-adv/unicast.c @@ -229,10 +229,12 @@ int frag_send_skb(struct sk_buff *skb, struct bat_priv *bat_priv, if (!bat_priv->primary_if) goto dropped; - unicast_packet = (struct unicast_packet *) skb->data; + frag_skb = dev_alloc_skb(data_len - (data_len / 2) + ucf_hdr_len); + if (!frag_skb) + goto dropped; + unicast_packet = (struct unicast_packet *) skb->data; memcpy(&tmp_uc, unicast_packet, uc_hdr_len); - frag_skb = dev_alloc_skb(data_len - (data_len / 2) + ucf_hdr_len); skb_split(skb, frag_skb, data_len / 2); if (my_skb_head_push(skb, ucf_hdr_len - uc_hdr_len) < 0 ||