From patchwork Thu Dec 26 17:57:01 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Simon Wunderlich X-Patchwork-Id: 3730 Return-Path: Received-SPF: None (no SPF record) identity=mailfrom; client-ip=79.140.42.25; helo=mail.mail.packetmixer.de; envelope-from=sw@simonwunderlich.de; receiver=b.a.t.m.a.n@lists.open-mesh.org Received: from mail.mail.packetmixer.de (packetmixer.de [79.140.42.25]) by open-mesh.org (Postfix) with ESMTPS id BFFEA602232 for ; Thu, 26 Dec 2013 18:57:21 +0100 (CET) Received: from kero.packetmixer.de (p579E7866.dip0.t-ipconnect.de [87.158.120.102]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mail.mail.packetmixer.de (Postfix) with ESMTPSA id 7D6F8623A6; Thu, 26 Dec 2013 17:58:51 +0000 (UTC) From: Simon Wunderlich To: b.a.t.m.a.n@lists.open-mesh.org Date: Thu, 26 Dec 2013 18:57:01 +0100 Message-Id: <1388080621-15040-1-git-send-email-sw@simonwunderlich.de> X-Mailer: git-send-email 1.7.10.4 Subject: [B.A.T.M.A.N.] [PATCHv2] batman-adv: fix NULL pointer deref in batadv_find_best_neighbor X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Dec 2013 17:57:22 -0000 If there is no best neighbor, don't dereference the NULL pointer. Try to acquire the neighbor node right in the loop instead. There also was a logic bug, finding the worst instead of the best neighbor. Introduced by 9bb33b8d88e318c4879d37d06ad28e3e018b9036 ("batman-adv: split tq information in neigh_node struct") Signed-off-by: Simon Wunderlich --- originator.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/originator.c b/originator.c index 2243003..4a5d027 100644 --- a/originator.c +++ b/originator.c @@ -783,14 +783,19 @@ batadv_find_best_neighbor(struct batadv_priv *bat_priv, struct batadv_algo_ops *bao = bat_priv->bat_algo_ops; rcu_read_lock(); - hlist_for_each_entry_rcu(neigh, &orig_node->neigh_list, list) - if (!best || - (bao->bat_neigh_cmp(neigh, if_outgoing, - best, if_outgoing) <= 0)) - best = neigh; + hlist_for_each_entry_rcu(neigh, &orig_node->neigh_list, list) { + if (best && (bao->bat_neigh_cmp(neigh, if_outgoing, + best, if_outgoing) <= 0)) + continue; - if (!atomic_inc_not_zero(&best->refcount)) - best = NULL; + if (!atomic_inc_not_zero(&neigh->refcount)) + continue; + + if (best) + batadv_neigh_node_free_ref(best); + + best = neigh; + } rcu_read_unlock(); return best;