diff mbox

batman-adv: fix kernel crash due to missing NULL checks

Message ID 1434537770-15161-1-git-send-email-mareklindner@neomailbox.ch (mailing list archive)
State Superseded, archived
Headers

Commit Message

Marek Lindner June 17, 2015, 10:42 a.m. UTC 
  batadv_softif_vlan_get() may return NULL which has to be verified
by the caller.

Reported-by: Ryan Thompson <ryan@eero.com>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
---
 soft-interface.c    |  3 +++
 translation-table.c | 17 +++++++++++++----
 2 files changed, 16 insertions(+), 4 deletions(-)

Comments

Antonio Quartulli June 17, 2015, 3:24 p.m. UTC | #1 
On 17/06/15 12:42, Marek Lindner wrote:
> batadv_softif_vlan_get() may return NULL which has to be verified
> by the caller.
> 
> Reported-by: Ryan Thompson <ryan@eero.com>
> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>

one comment is inline:

> ---
>  soft-interface.c    |  3 +++
>  translation-table.c | 17 +++++++++++++----
>  2 files changed, 16 insertions(+), 4 deletions(-)
> 
> diff --git a/soft-interface.c b/soft-interface.c
> index da89336..7841a4b 100644
> --- a/soft-interface.c
> +++ b/soft-interface.c
> @@ -455,6 +455,9 @@ out:
>   */
>  void batadv_softif_vlan_free_ref(struct batadv_softif_vlan *vlan)
>  {
> +	if (!vlan)
> +		return;
> +
>  	if (atomic_dec_and_test(&vlan->refcount)) {
>  		spin_lock_bh(&vlan->bat_priv->softif_vlan_list_lock);
>  		hlist_del_rcu(&vlan->list);
> diff --git a/translation-table.c b/translation-table.c
> index e95a424..efbcb59 100644
> --- a/translation-table.c
> +++ b/translation-table.c
> @@ -575,6 +575,8 @@ bool batadv_tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
>  
>  	/* increase the refcounter of the related vlan */
>  	vlan = batadv_softif_vlan_get(bat_priv, vid);
> +	if (!vlan)
> +		goto out;

In this case I'd use a WARN here because if we are adding a local client
to a specific VLAN the assumption is that batman-adv is already aware of
this VLAN, therefore this condition is not expected to be true.


Cheers,
diff mbox

Patch

diff --git a/soft-interface.c b/soft-interface.c
index da89336..7841a4b 100644
--- a/soft-interface.c
+++ b/soft-interface.c
@@ -455,6 +455,9 @@  out:
  */
 void batadv_softif_vlan_free_ref(struct batadv_softif_vlan *vlan)
 {
+	if (!vlan)
+		return;
+
 	if (atomic_dec_and_test(&vlan->refcount)) {
 		spin_lock_bh(&vlan->bat_priv->softif_vlan_list_lock);
 		hlist_del_rcu(&vlan->list);
diff --git a/translation-table.c b/translation-table.c
index e95a424..efbcb59 100644
--- a/translation-table.c
+++ b/translation-table.c
@@ -575,6 +575,8 @@  bool batadv_tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
 
 	/* increase the refcounter of the related vlan */
 	vlan = batadv_softif_vlan_get(bat_priv, vid);
+	if (!vlan)
+		goto out;
 
 	batadv_dbg(BATADV_DBG_TT, bat_priv,
 		   "Creating new local tt entry: %pM (vid: %d, ttvn: %d)\n",
@@ -1047,6 +1049,9 @@  uint16_t batadv_tt_local_remove(struct batadv_priv *bat_priv,
 
 	/* decrease the reference held for this vlan */
 	vlan = batadv_softif_vlan_get(bat_priv, vid);
+	if (!vlan)
+		goto out;
+
 	batadv_softif_vlan_free_ref(vlan);
 	batadv_softif_vlan_free_ref(vlan);
 
@@ -1147,8 +1152,10 @@  static void batadv_tt_local_table_free(struct batadv_priv *bat_priv)
 			/* decrease the reference held for this vlan */
 			vlan = batadv_softif_vlan_get(bat_priv,
 						      tt_common_entry->vid);
-			batadv_softif_vlan_free_ref(vlan);
-			batadv_softif_vlan_free_ref(vlan);
+			if (vlan) {
+				batadv_softif_vlan_free_ref(vlan);
+				batadv_softif_vlan_free_ref(vlan);
+			}
 
 			batadv_tt_local_entry_free_ref(tt_local);
 		}
@@ -3188,8 +3195,10 @@  static void batadv_tt_local_purge_pending_clients(struct batadv_priv *bat_priv)
 
 			/* decrease the reference held for this vlan */
 			vlan = batadv_softif_vlan_get(bat_priv, tt_common->vid);
-			batadv_softif_vlan_free_ref(vlan);
-			batadv_softif_vlan_free_ref(vlan);
+			if (vlan) {
+				batadv_softif_vlan_free_ref(vlan);
+				batadv_softif_vlan_free_ref(vlan);
+			}
 
 			batadv_tt_local_entry_free_ref(tt_local);
 		}