From patchwork Mon Feb 22 21:56:33 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sven Eckelmann X-Patchwork-Id: 15815 X-Patchwork-Delegate: mareklindner@neomailbox.ch Return-Path: X-Original-To: patchwork@open-mesh.org Delivered-To: patchwork@open-mesh.org Received: from open-mesh.org (localhost [127.0.0.1]) by open-mesh.org (Postfix) with ESMTP id 6BA7982391; Mon, 22 Feb 2016 22:56:39 +0100 (CET) Authentication-Results: open-mesh.org; dkim=fail reason="verification failed; unprotected key" header.d=narfation.org header.i=@narfation.org header.b=IyPcF6WV; dkim-adsp=fail (unprotected policy); dkim-atps=neutral Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=79.140.41.39; helo=v3-1039.vlinux.de; envelope-from=sven@narfation.org; receiver=b.a.t.m.a.n@lists.open-mesh.org Authentication-Results: open-mesh.org; dmarc=pass header.from=narfation.org Received: from v3-1039.vlinux.de (narfation.org [79.140.41.39]) by open-mesh.org (Postfix) with ESMTPS id 9839982390 for ; Mon, 22 Feb 2016 22:56:38 +0100 (CET) Received: from sven-desktop.home.narfation.org (p200300C593C034FD325A3AFFFE531AE5.dip0.t-ipconnect.de [IPv6:2003:c5:93c0:34fd:325a:3aff:fe53:1ae5]) by v3-1039.vlinux.de (Postfix) with ESMTPSA id 016FC1100E6; Mon, 22 Feb 2016 22:56:37 +0100 (CET) Authentication-Results: v3-1039.vlinux.de; dmarc=none header.from=narfation.org DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=narfation.org; s=20121; t=1456178198; bh=IgfRLPh9lCWCv3bTpJ6r7g9EiF148abMNayAf0y9RaE=; h=From:To:Cc:Subject:Date:From; b=IyPcF6WVBDLswMIbopsRZPygZKsTnz83Jl9UPI2ocQfPdsoHUXOXS5kUQZfFLfXv/ YfKBvfNAvY/bDJZUbtoo6h4J0jwcsm9+w9G3BY1ESrL8t3cK55hQQ5/DrF1MuqnAsH 5/qJT5zGcxCRJMCuQMeCBx2nhCefcnM73u5T+WME= From: Sven Eckelmann To: b.a.t.m.a.n@lists.open-mesh.org Date: Mon, 22 Feb 2016 22:56:33 +0100 Message-Id: <1456178194-29307-1-git-send-email-sven@narfation.org> X-Mailer: git-send-email 2.7.0 Subject: [B.A.T.M.A.N.] [PATCH 1/2] batman-adv: Fix unexpected free of bcast_own on add_if error X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking Errors-To: b.a.t.m.a.n-bounces@lists.open-mesh.org Sender: "B.A.T.M.A.N" The function batadv_iv_ogm_orig_add_if allocates new buffers for bcast_own and bcast_own_sum. It is expected that these buffers are unchanged in case either bcast_own or bcast_own_sum couldn't be resized. But the error handling of this function frees the already resized buffer for bcast_own when the allocation of the new bcast_own_sum buffer failed. This will lead to an invalid memory access when some code will try to access bcast_own. Instead the resized new bcast_own buffer has to be kept. This will not lead to problems because the size of the buffer was only increased and therefore no user of the buffer will try to access bytes outside of the new buffer. Fixes: fdafa7d29ace ("batman-adv: provide orig_node routing API") Signed-off-by: Sven Eckelmann --- net/batman-adv/bat_iv_ogm.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c index cb2d1b9..af8bd86 100644 --- a/net/batman-adv/bat_iv_ogm.c +++ b/net/batman-adv/bat_iv_ogm.c @@ -156,10 +156,8 @@ static int batadv_iv_ogm_orig_add_if(struct batadv_orig_node *orig_node, orig_node->bat_iv.bcast_own = data_ptr; data_ptr = kmalloc_array(max_if_num, sizeof(u8), GFP_ATOMIC); - if (!data_ptr) { - kfree(orig_node->bat_iv.bcast_own); + if (!data_ptr) goto unlock; - } memcpy(data_ptr, orig_node->bat_iv.bcast_own_sum, (max_if_num - 1) * sizeof(u8));