* [B.A.T.M.A.N.] [PATCH] batman-adv: fix cleanup in send_tt_request()
@ 2011-06-16 10:37 Marek Lindner
2011-06-16 13:21 ` Antonio Quartulli
0 siblings, 1 reply; 3+ messages in thread
From: Marek Lindner @ 2011-06-16 10:37 UTC (permalink / raw)
To: b.a.t.m.a.n; +Cc: Marek Lindner
The ret variable was never set to any value other than 0, therefore
the skb and tt_req_node would not be freed in case of an error.
Furthermore, the code assumed tt_req_node being always a valid
pointer by dereferencing it in the cleanup part.
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
---
translation-table.c | 9 +++++----
1 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/translation-table.c b/translation-table.c
index 373ee81..5f1fcd5 100644
--- a/translation-table.c
+++ b/translation-table.c
@@ -1012,12 +1012,12 @@ out:
int send_tt_request(struct bat_priv *bat_priv, struct orig_node *dst_orig_node,
uint8_t ttvn, uint16_t tt_crc, bool full_table)
{
- struct sk_buff *skb;
+ struct sk_buff *skb = NULL;
struct tt_query_packet *tt_request;
struct neigh_node *neigh_node = NULL;
struct hard_iface *primary_if;
- struct tt_req_node *tt_req_node;
- int ret = 0;
+ struct tt_req_node *tt_req_node = NULL;
+ int ret = 1;
primary_if = primary_if_get_selected(bat_priv);
if (!primary_if)
@@ -1066,8 +1066,9 @@ out:
neigh_node_free_ref(neigh_node);
if (primary_if)
hardif_free_ref(primary_if);
- if (ret) {
+ if (ret)
kfree_skb(skb);
+ if (ret && tt_req_node) {
spin_lock_bh(&bat_priv->tt_req_list_lock);
list_del(&tt_req_node->list);
spin_unlock_bh(&bat_priv->tt_req_list_lock);
--
1.7.5.3
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [B.A.T.M.A.N.] [PATCH] batman-adv: fix cleanup in send_tt_request()
2011-06-16 10:37 [B.A.T.M.A.N.] [PATCH] batman-adv: fix cleanup in send_tt_request() Marek Lindner
@ 2011-06-16 13:21 ` Antonio Quartulli
2011-06-17 5:55 ` Marek Lindner
0 siblings, 1 reply; 3+ messages in thread
From: Antonio Quartulli @ 2011-06-16 13:21 UTC (permalink / raw)
To: The list for a Better Approach To Mobile Ad-hoc Networking
On gio, giu 16, 2011 at 12:37:07 +0200, Marek Lindner wrote:
> The ret variable was never set to any value other than 0, therefore
> the skb and tt_req_node would not be freed in case of an error.
> Furthermore, the code assumed tt_req_node being always a valid
> pointer by dereferencing it in the cleanup part.
>
> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
Acked-by: Antonio Quartulli <ordex@autistici.org>
--
Antonio Quartulli
..each of us alone is worth nothing..
Ernesto "Che" Guevara
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [B.A.T.M.A.N.] [PATCH] batman-adv: fix cleanup in send_tt_request()
2011-06-16 13:21 ` Antonio Quartulli
@ 2011-06-17 5:55 ` Marek Lindner
0 siblings, 0 replies; 3+ messages in thread
From: Marek Lindner @ 2011-06-17 5:55 UTC (permalink / raw)
To: The list for a Better Approach To Mobile Ad-hoc Networking
On Thursday, June 16, 2011 03:21:49 PM Antonio Quartulli wrote:
> On gio, giu 16, 2011 at 12:37:07 +0200, Marek Lindner wrote:
> > The ret variable was never set to any value other than 0, therefore
> > the skb and tt_req_node would not be freed in case of an error.
> > Furthermore, the code assumed tt_req_node being always a valid
> > pointer by dereferencing it in the cleanup part.
> >
> >
> >
> > Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
>
> Acked-by: Antonio Quartulli <ordex@autistici.org>
Applied in revision 74db080.
Thanks,
Marek
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2011-06-17 5:55 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-06-16 10:37 [B.A.T.M.A.N.] [PATCH] batman-adv: fix cleanup in send_tt_request() Marek Lindner
2011-06-16 13:21 ` Antonio Quartulli
2011-06-17 5:55 ` Marek Lindner
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).