batman-adv/patches/0005-batman-adv-Fix-double-neigh_node_put-in-batadv_v_ogm.patch

   1 From fc3e79d9ef2a1006f94e441d9613749cbbe7176a Mon Sep 17 00:00:00 2001
   2 From: Sven Eckelmann <sven@narfation.org>
   3 Date: Fri, 6 May 2016 22:27:09 +0200
   4 Subject: [PATCH 5/6] batman-adv: Fix double neigh_node_put in
   5  batadv_v_ogm_route_update
   6
   7 The router is put down twice when it was non-NULL and either orig_ifinfo is
   8 NULL afterwards or batman-adv receives a packet with the same sequence
   9 number. This will end up in a use-after-free when the batadv_neigh_node is
  10 removed because the reference counter ended up too early at 0.
  11
  12 Fixes: 667996ebeab4 ("batman-adv: OGMv2 - implement originators logic")
  13 Reported-by: Gui Iribarren <gui@altermundi.net>
  14 Tested-by: Antonio Quartulli <a@unstable.cc>
  15 Tested-by: Marek Lindner <mareklindner@neomailbox.ch>
  16 Signed-off-by: Sven Eckelmann <sven@narfation.org>
  17 Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
  18 ---
  19  net/batman-adv/bat_v_ogm.c | 4 +++-
  20  1 file changed, 3 insertions(+), 1 deletion(-)
  21
  22 diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c
  23 index d9bcbe6..91df28a 100644
  24 --- a/net/batman-adv/bat_v_ogm.c
  25 +++ b/net/batman-adv/bat_v_ogm.c
  26 @@ -529,8 +529,10 @@ static void batadv_v_ogm_route_update(struct batadv_priv *bat_priv,
  27                 goto out;
  28         }
  29
  30 -       if (router)
  31 +       if (router) {
  32                 batadv_neigh_node_put(router);
  33 +               router = NULL;
  34 +       }
  35
  36         /* Update routes, and check if the OGM is from the best next hop */
  37         batadv_v_ogm_orig_update(bat_priv, orig_node, neigh_node, ogm2,
  38 --
  39 2.8.0.rc3
  40