| From foo@baz Thu Feb 27 20:11:26 PST 2014 |
| From: Antonio Quartulli <antonio@meshcoding.com> |
| Date: Sat, 15 Feb 2014 02:17:20 +0100 |
| Subject: batman-adv: avoid double free when orig_node initialization fails |
| |
| From: Antonio Quartulli <antonio@meshcoding.com> |
| |
| [ Upstream commit a5a5cb8cab526af2f6cbe9715f8ca843192f0d81 ] |
| |
| In the failure path of the orig_node initialization routine |
| the orig_node->bat_iv.bcast_own field is free'd twice: first |
| in batadv_iv_ogm_orig_get() and then later in |
| batadv_orig_node_free_rcu(). |
| |
| Fix it by removing the kfree in batadv_iv_ogm_orig_get(). |
| |
| Signed-off-by: Antonio Quartulli <antonio@meshcoding.com> |
| Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/batman-adv/bat_iv_ogm.c | 6 ++---- |
| 1 file changed, 2 insertions(+), 4 deletions(-) |
| |
| --- a/net/batman-adv/bat_iv_ogm.c |
| +++ b/net/batman-adv/bat_iv_ogm.c |
| @@ -243,18 +243,16 @@ batadv_iv_ogm_orig_get(struct batadv_pri |
| size = bat_priv->num_ifaces * sizeof(uint8_t); |
| orig_node->bat_iv.bcast_own_sum = kzalloc(size, GFP_ATOMIC); |
| if (!orig_node->bat_iv.bcast_own_sum) |
| - goto free_bcast_own; |
| + goto free_orig_node; |
| |
| hash_added = batadv_hash_add(bat_priv->orig_hash, batadv_compare_orig, |
| batadv_choose_orig, orig_node, |
| &orig_node->hash_entry); |
| if (hash_added != 0) |
| - goto free_bcast_own; |
| + goto free_orig_node; |
| |
| return orig_node; |
| |
| -free_bcast_own: |
| - kfree(orig_node->bat_iv.bcast_own); |
| free_orig_node: |
| /* free twice, as batadv_orig_node_new sets refcount to 2 */ |
| batadv_orig_node_free_ref(orig_node); |