diff mbox

[1/2] batman-adv: Fix unexpected free of bcast_own on add_if error

Message ID 1456178194-29307-1-git-send-email-sven@narfation.org (mailing list archive)
State Accepted, archived
Commit 32bcb3f6e3cf92d9c1d19f0d254c094c119da811
Delegated to: Marek Lindner
Headers

Commit Message

Sven Eckelmann Feb. 22, 2016, 9:56 p.m. UTC 
  The function batadv_iv_ogm_orig_add_if allocates new buffers for bcast_own
and bcast_own_sum. It is expected that these buffers are unchanged in case
either bcast_own or bcast_own_sum couldn't be resized.

But the error handling of this function frees the already resized buffer
for bcast_own when the allocation of the new bcast_own_sum buffer failed.
This will lead to an invalid memory access when some code will try to
access bcast_own.

Instead the resized new bcast_own buffer has to be kept. This will not lead
to problems because the size of the buffer was only increased and therefore
no user of the buffer will try to access bytes outside of the new buffer.

Fixes: fdafa7d29ace ("batman-adv: provide orig_node routing API")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
 net/batman-adv/bat_iv_ogm.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

Comments

Marek Lindner Feb. 27, 2016, 11:33 p.m. UTC | #1 
On Monday, February 22, 2016 22:56:33 Sven Eckelmann wrote:
> The function batadv_iv_ogm_orig_add_if allocates new buffers for bcast_own
> and bcast_own_sum. It is expected that these buffers are unchanged in case
> either bcast_own or bcast_own_sum couldn't be resized.
> 
> But the error handling of this function frees the already resized buffer
> for bcast_own when the allocation of the new bcast_own_sum buffer failed.
> This will lead to an invalid memory access when some code will try to
> access bcast_own.
> 
> Instead the resized new bcast_own buffer has to be kept. This will not lead
> to problems because the size of the buffer was only increased and therefore
> no user of the buffer will try to access bytes outside of the new buffer.
> 
> Fixes: fdafa7d29ace ("batman-adv: provide orig_node routing API")
> Signed-off-by: Sven Eckelmann <sven@narfation.org>
> ---
>  net/batman-adv/bat_iv_ogm.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)

Applied in revision 32bcb3f.

Thanks,
Marek
diff mbox

Patch

diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index cb2d1b9..af8bd86 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -156,10 +156,8 @@  static int batadv_iv_ogm_orig_add_if(struct batadv_orig_node *orig_node,
 	orig_node->bat_iv.bcast_own = data_ptr;
 
 	data_ptr = kmalloc_array(max_if_num, sizeof(u8), GFP_ATOMIC);
-	if (!data_ptr) {
-		kfree(orig_node->bat_iv.bcast_own);
+	if (!data_ptr)
 		goto unlock;
-	}
 
 	memcpy(data_ptr, orig_node->bat_iv.bcast_own_sum,
 	       (max_if_num - 1) * sizeof(u8));