* [B.A.T.M.A.N.] [PATCHv2] batman-adv: fix NULL pointer deref in batadv_find_best_neighbor
@ 2013-12-26 17:57 Simon Wunderlich
2013-12-28 8:39 ` Marek Lindner
0 siblings, 1 reply; 2+ messages in thread
From: Simon Wunderlich @ 2013-12-26 17:57 UTC (permalink / raw)
To: b.a.t.m.a.n
If there is no best neighbor, don't dereference the NULL pointer. Try to
acquire the neighbor node right in the loop instead. There also was a
logic bug, finding the worst instead of the best neighbor.
Introduced by 9bb33b8d88e318c4879d37d06ad28e3e018b9036 ("batman-adv:
split tq information in neigh_node struct")
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
originator.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
diff --git a/originator.c b/originator.c
index 2243003..4a5d027 100644
--- a/originator.c
+++ b/originator.c
@@ -783,14 +783,19 @@ batadv_find_best_neighbor(struct batadv_priv *bat_priv,
struct batadv_algo_ops *bao = bat_priv->bat_algo_ops;
rcu_read_lock();
- hlist_for_each_entry_rcu(neigh, &orig_node->neigh_list, list)
- if (!best ||
- (bao->bat_neigh_cmp(neigh, if_outgoing,
- best, if_outgoing) <= 0))
- best = neigh;
+ hlist_for_each_entry_rcu(neigh, &orig_node->neigh_list, list) {
+ if (best && (bao->bat_neigh_cmp(neigh, if_outgoing,
+ best, if_outgoing) <= 0))
+ continue;
- if (!atomic_inc_not_zero(&best->refcount))
- best = NULL;
+ if (!atomic_inc_not_zero(&neigh->refcount))
+ continue;
+
+ if (best)
+ batadv_neigh_node_free_ref(best);
+
+ best = neigh;
+ }
rcu_read_unlock();
return best;
--
1.7.10.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [B.A.T.M.A.N.] [PATCHv2] batman-adv: fix NULL pointer deref in batadv_find_best_neighbor
2013-12-26 17:57 [B.A.T.M.A.N.] [PATCHv2] batman-adv: fix NULL pointer deref in batadv_find_best_neighbor Simon Wunderlich
@ 2013-12-28 8:39 ` Marek Lindner
0 siblings, 0 replies; 2+ messages in thread
From: Marek Lindner @ 2013-12-28 8:39 UTC (permalink / raw)
To: b.a.t.m.a.n
[-- Attachment #1: Type: text/plain, Size: 597 bytes --]
On Thursday 26 December 2013 18:57:01 Simon Wunderlich wrote:
> If there is no best neighbor, don't dereference the NULL pointer. Try to
> acquire the neighbor node right in the loop instead. There also was a
> logic bug, finding the worst instead of the best neighbor.
>
> Introduced by 9bb33b8d88e318c4879d37d06ad28e3e018b9036 ("batman-adv:
> split tq information in neigh_node struct")
>
> Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
> ---
> originator.c | 19 ++++++++++++-------
> 1 file changed, 12 insertions(+), 7 deletions(-)
Applied in revision 183150b.
Thanks,
Marek
[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 490 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-12-28 8:39 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-12-26 17:57 [B.A.T.M.A.N.] [PATCHv2] batman-adv: fix NULL pointer deref in batadv_find_best_neighbor Simon Wunderlich
2013-12-28 8:39 ` Marek Lindner
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).