| From c2d0f48a13e53b4747704c9e692f5e765e52041a Mon Sep 17 00:00:00 2001 |
| From: Sven Eckelmann <sven@narfation.org> |
| Date: Wed, 30 Nov 2016 21:47:09 +0100 |
| Subject: batman-adv: Check for alloc errors when preparing TT local data |
| |
| From: Sven Eckelmann <sven@narfation.org> |
| |
| commit c2d0f48a13e53b4747704c9e692f5e765e52041a upstream. |
| |
| batadv_tt_prepare_tvlv_local_data can fail to allocate the memory for the |
| new TVLV block. The caller is informed about this problem with the returned |
| length of 0. Not checking this value results in an invalid memory access |
| when either tt_data or tt_change is accessed. |
| |
| Reported-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific") |
| Signed-off-by: Sven Eckelmann <sven@narfation.org> |
| Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| net/batman-adv/translation-table.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/net/batman-adv/translation-table.c |
| +++ b/net/batman-adv/translation-table.c |
| @@ -2764,7 +2764,7 @@ static bool batadv_send_my_tt_response(s |
| &tvlv_tt_data, |
| &tt_change, |
| &tt_len); |
| - if (!tt_len) |
| + if (!tt_len || !tvlv_len) |
| goto unlock; |
| |
| /* Copy the last orig_node's OGM buffer */ |
| @@ -2782,7 +2782,7 @@ static bool batadv_send_my_tt_response(s |
| &tvlv_tt_data, |
| &tt_change, |
| &tt_len); |
| - if (!tt_len) |
| + if (!tt_len || !tvlv_len) |
| goto out; |
| |
| /* fill the rest of the tvlv with the real TT entries */ |
