From patchwork Thu Jan 13 20:53:38 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jesper Juhl X-Patchwork-Id: 698 Return-Path: X-Greylist: delayed 4200 seconds by postgrey-1.31 at open-mesh; Fri, 14 Jan 2011 03:49:35 CET Received: from swampdragon.chaosbits.net (swampdragon.chaosbits.net [90.184.90.115]) by open-mesh.org (Postfix) with ESMTP id 7004B1541D9 for ; Fri, 14 Jan 2011 03:49:35 +0100 (CET) Received: by swampdragon.chaosbits.net (Postfix, from userid 1000) id C8A6C9403D; Thu, 13 Jan 2011 21:53:38 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by swampdragon.chaosbits.net (Postfix) with ESMTP id C65DD9403B; Thu, 13 Jan 2011 21:53:38 +0100 (CET) Date: Thu, 13 Jan 2011 21:53:38 +0100 (CET) From: Jesper Juhl To: b.a.t.m.a.n@lists.open-mesh.org Message-ID: User-Agent: Alpine 2.00 (LNX 1167 2008-08-23) MIME-Version: 1.0 X-Mailman-Approved-At: Fri, 14 Jan 2011 05:32:05 +0100 Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Simon Wunderlich , Marek Lindner , "David S. Miller" Subject: [B.A.T.M.A.N.] [PATCH] Even Batman should not dereference NULL pointers X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.11 Precedence: list Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Jan 2011 02:49:35 -0000 There's a problem in net/batman-adv/unicast.c::frag_send_skb(). dev_alloc_skb() allocates memory and may fail, thus returning NULL. If this happens we'll pass a NULL pointer on to skb_split() which in turn hands it to skb_split_inside_header() from where it gets passed to skb_put() that lets skb_tail_pointer() play with it and that function dereferences it. And thus the bat dies. While I was at it I also moved the call to dev_alloc_skb() above the assignment to 'unicast_packet' since there's no reason to do that assignment if the memory allocation fails. Signed-off-by: Jesper Juhl --- unicast.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/batman-adv/unicast.c b/net/batman-adv/unicast.c index dc2e28b..ee41fef 100644 --- a/net/batman-adv/unicast.c +++ b/net/batman-adv/unicast.c @@ -229,10 +229,12 @@ int frag_send_skb(struct sk_buff *skb, struct bat_priv *bat_priv, if (!bat_priv->primary_if) goto dropped; - unicast_packet = (struct unicast_packet *) skb->data; + frag_skb = dev_alloc_skb(data_len - (data_len / 2) + ucf_hdr_len); + if (!frag_skb) + goto dropped; + unicast_packet = (struct unicast_packet *) skb->data; memcpy(&tmp_uc, unicast_packet, uc_hdr_len); - frag_skb = dev_alloc_skb(data_len - (data_len / 2) + ucf_hdr_len); skb_split(skb, frag_skb, data_len / 2); if (my_skb_head_push(skb, ucf_hdr_len - uc_hdr_len) < 0 ||