| From foo@baz Thu Feb 27 20:11:26 PST 2014 |
| From: Simon Wunderlich <sw@simonwunderlich.de> |
| Date: Sat, 8 Feb 2014 16:45:06 +0100 |
| Subject: batman-adv: fix potential orig_node reference leak |
| |
| From: Simon Wunderlich <sw@simonwunderlich.de> |
| |
| [ Upstream commit b2262df7fcf2c395eca564df83238e931d88d7bf ] |
| |
| Since batadv_orig_node_new() sets the refcount to two, assuming that |
| the calling function will use a reference for putting the orig_node into |
| a hash or similar, both references must be freed if initialization of |
| the orig_node fails. Otherwise that object may be leaked in that error |
| case. |
| |
| Reported-by: Antonio Quartulli <antonio@meshcoding.com> |
| Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de> |
| Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch> |
| Signed-off-by: Antonio Quartulli <antonio@meshcoding.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/batman-adv/bat_iv_ogm.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| --- a/net/batman-adv/bat_iv_ogm.c |
| +++ b/net/batman-adv/bat_iv_ogm.c |
| @@ -256,6 +256,8 @@ batadv_iv_ogm_orig_get(struct batadv_pri |
| free_bcast_own: |
| kfree(orig_node->bat_iv.bcast_own); |
| free_orig_node: |
| + /* free twice, as batadv_orig_node_new sets refcount to 2 */ |
| + batadv_orig_node_free_ref(orig_node); |
| batadv_orig_node_free_ref(orig_node); |
| |
| return NULL; |
