From: "Linus Lüssing" <linus.luessing@c0d3.blue>
To: The list for a Better Approach To Mobile Ad-hoc Networking
<b.a.t.m.a.n@lists.open-mesh.org>
Subject: Re: [PATCH] batman-adv: Fix deletion of RTR(4|6) mcast list entries
Date: Sun, 7 Jul 2019 23:47:43 +0200 [thread overview]
Message-ID: <20190707214743.GA2466@otheros> (raw)
In-Reply-To: <20190707210457.20892-1-sven@narfation.org>
On Sun, Jul 07, 2019 at 11:04:57PM +0200, Sven Eckelmann wrote:
> The multicast code uses the lists bat_priv->mcast.want_all_rtr*_list to
> store all all originator nodes which don't have the flag no-RTR4 or no-RTR6
> set. When an originator is purged, it has to be removed from these lists.
>
> Since all entries without the BATADV_MCAST_WANT_NO_RTR4/6 are stored in
> these lists, they have to be handled like entries which have these flags
> set to force the update routines to remove them from the lists when purging
> the originator.
>
> Not doing so will leave a pointer to a freed memory region inside the list.
> Trying to operate on these lists will then cause an use-after-free error:
>
> BUG: KASAN: use-after-free in batadv_mcast_want_rtr4_update+0x335/0x3a0 [batman_adv]
> Write of size 8 at addr ffff888007b41a38 by task swapper/0/0
>
> Fixes: 0a7733468f95 ("batman-adv: mcast: detect, distribute and maintain multicast router presence")
> Signed-off-by: Sven Eckelmann <sven@narfation.org>
> ---
> Cc: Linus Lüssing <linus.luessing@c0d3.blue>
>
> See https://www.open-mesh.org/issues/395
> ---
Acked-by: Linus Lüssing <linus.luessing@c0d3.blue>
prev parent reply other threads:[~2019-07-07 21:47 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-07 21:04 [PATCH] batman-adv: Fix deletion of RTR(4|6) mcast list entries Sven Eckelmann
2019-07-07 21:47 ` Linus Lüssing [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190707214743.GA2466@otheros \
--to=linus.luessing@c0d3.blue \
--cc=b.a.t.m.a.n@lists.open-mesh.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).