batman-adv/patches/0004-batman-adv-Fix-refcnt-leak-in-batadv_v_neigh_.patch

   1 From 650d41de4be2fe9e9d1842c1abdd357dedbaa7ba Mon Sep 17 00:00:00 2001
   2 From: Sven Eckelmann <sven@narfation.org>
   3 Date: Fri, 6 May 2016 11:43:39 +0200
   4 Subject: [PATCH 4/6] batman-adv: Fix refcnt leak in batadv_v_neigh_*
   5
   6 The functions batadv_neigh_ifinfo_get increase the reference counter of the
   7 batadv_neigh_ifinfo. These have to be reduced again when the reference is
   8 not used anymore to correctly free the objects.
   9
  10 Fixes: b05bbab5e1fc ("batman-adv: B.A.T.M.A.N. V - implement neighbor comparison API calls")
  11 Signed-off-by: Sven Eckelmann <sven@narfation.org>
  12 Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
  13 ---
  14  net/batman-adv/bat_v.c | 32 +++++++++++++++++++++++++-------
  15  1 file changed, 25 insertions(+), 7 deletions(-)
  16
  17 diff --git a/net/batman-adv/bat_v.c b/net/batman-adv/bat_v.c
  18 index 7e1467a..2bcb29b 100644
  19 --- a/net/batman-adv/bat_v.c
  20 +++ b/net/batman-adv/bat_v.c
  21 @@ -274,14 +274,23 @@ static int batadv_v_neigh_cmp(struct batadv_neigh_node *neigh1,
  22                               struct batadv_hard_iface *if_outgoing2)
  23  {
  24         struct batadv_neigh_ifinfo *ifinfo1, *ifinfo2;
  25 +       int ret = 0;
  26
  27         ifinfo1 = batadv_neigh_ifinfo_get(neigh1, if_outgoing1);
  28 +       if (WARN_ON(!ifinfo1))
  29 +               goto err_ifinfo1;
  30 +
  31         ifinfo2 = batadv_neigh_ifinfo_get(neigh2, if_outgoing2);
  32 +       if (WARN_ON(!ifinfo2))
  33 +               goto err_ifinfo2;
  34
  35 -       if (WARN_ON(!ifinfo1 || !ifinfo2))
  36 -               return 0;
  37 +       ret = ifinfo1->bat_v.throughput - ifinfo2->bat_v.throughput;
  38
  39 -       return ifinfo1->bat_v.throughput - ifinfo2->bat_v.throughput;
  40 +       batadv_neigh_ifinfo_put(ifinfo2);
  41 +err_ifinfo2:
  42 +       batadv_neigh_ifinfo_put(ifinfo1);
  43 +err_ifinfo1:
  44 +       return ret;
  45  }
  46
  47  static bool batadv_v_neigh_is_sob(struct batadv_neigh_node *neigh1,
  48 @@ -291,17 +300,26 @@ static bool batadv_v_neigh_is_sob(struct batadv_neigh_node *neigh1,
  49  {
  50         struct batadv_neigh_ifinfo *ifinfo1, *ifinfo2;
  51         u32 threshold;
  52 +       bool ret = false;
  53
  54         ifinfo1 = batadv_neigh_ifinfo_get(neigh1, if_outgoing1);
  55 -       ifinfo2 = batadv_neigh_ifinfo_get(neigh2, if_outgoing2);
  56 +       if (WARN_ON(!ifinfo1))
  57 +               goto err_ifinfo1;
  58
  59 -       if (WARN_ON(!ifinfo1 || !ifinfo2))
  60 -               return false;
  61 +       ifinfo2 = batadv_neigh_ifinfo_get(neigh2, if_outgoing2);
  62 +       if (WARN_ON(!ifinfo2))
  63 +               goto err_ifinfo2;
  64
  65         threshold = ifinfo1->bat_v.throughput / 4;
  66         threshold = ifinfo1->bat_v.throughput - threshold;
  67
  68 -       return ifinfo2->bat_v.throughput > threshold;
  69 +       ret = ifinfo2->bat_v.throughput > threshold;
  70 +
  71 +       batadv_neigh_ifinfo_put(ifinfo2);
  72 +err_ifinfo2:
  73 +       batadv_neigh_ifinfo_put(ifinfo1);
  74 +err_ifinfo1:
  75 +       return ret;
  76  }
  77
  78  static struct batadv_algo_ops batadv_batman_v __read_mostly = {
  79 --
  80 2.8.0.rc3
  81