Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e050dbeb authored by Sven Eckelmann's avatar Sven Eckelmann Committed by David S. Miller
Browse files

batman-adv: Fix parameter order of hlist_add_behind 



1d023284 ("list: fix order of arguments for
hlist_add_after(_rcu)") was incorrectly rebased on top of
d9124268 ("batman-adv: Fix out-of-order
fragmentation support"). The parameter order change of the rebased patch was
not re-applied as expected. This causes a memory leak and can cause crashes
when out-of-order packets are received. hlist_add_behind will try to access the
uninitalized list pointers of frag_entry_new to find the previous/next entry
and may modify/read random memory locations.

Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent ed607b82

net/batman-adv/fragmentation.c

+1 −1
Original line number Diff line number Diff line
@@ -188,7 +188,7 @@ static bool batadv_frag_insert_packet(struct batadv_orig_node *orig_node, 


	/* Reached the end of the list, so insert after 'frag_entry_last'. */

	if (likely(frag_entry_last)) {

		hlist_add_behind(&frag_entry_last->list, &frag_entry_new->list);

		hlist_add_behind(&frag_entry_new->list, &frag_entry_last->list);

		chain->size += skb->len - hdr_size;

		chain->timestamp = jiffies;

		ret = true;