From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:33699 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751164AbcFDTnl (ORCPT ); Sat, 4 Jun 2016 15:43:41 -0400 Subject: Patch "batman-adv: Fix double neigh_node_put in batadv_v_ogm_route_update" has been added to the 4.6-stable tree To: a@unstable.cc, gregkh@linuxfoundation.org, sven@narfation.org Cc: , From: Date: Sat, 04 Jun 2016 12:43:40 -0700 In-Reply-To: <20160521094817.401-1-a@unstable.cc> Message-ID: <146506942014525@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled batman-adv: Fix double neigh_node_put in batadv_v_ogm_route_update to the 4.6-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: batman-adv-fix-double-neigh_node_put-in-batadv_v_ogm_route_update.patch and it can be found in the queue-4.6 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From a@unstable.cc Sat Jun 4 12:37:07 2016 From: Antonio Quartulli Date: Sat, 21 May 2016 17:48:17 +0800 Subject: batman-adv: Fix double neigh_node_put in batadv_v_ogm_route_update To: stable@vger.kernel.org Cc: b.a.t.m.a.n@lists.open-mesh.org, Sven Eckelmann , Antonio Quartulli Message-ID: <20160521094817.401-1-a@unstable.cc> From: Sven Eckelmann The router is put down twice when it was non-NULL and either orig_ifinfo is NULL afterwards or batman-adv receives a packet with the same sequence number. This will end up in a use-after-free when the batadv_neigh_node is removed because the reference counter ended up too early at 0. This patch is skipping netdev and is being sent directly to stable in accordance with David S. Miller[1]. The reason is that this patch applies only on linux-4.6 and not on linux-4.7/net because it was "accidentally" fixed by a refactoring commit (more details in [2]). It addresses a reference imbalance which systematically leads to a use-after-free and then a kernel crash. [1] https://www.mail-archive.com/b.a.t.m.a.n@lists.open-mesh.org/msg15258.html [2] https://www.mail-archive.com/b.a.t.m.a.n@lists.open-mesh.org/msg15252.html Fixes: 9323158ef9f4 ("batman-adv: OGMv2 - implement originators logic") Signed-off-by: Sven Eckelmann Signed-off-by: Antonio Quartulli Signed-off-by: Greg Kroah-Hartman --- Cheers, net/batman-adv/bat_v_ogm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/net/batman-adv/bat_v_ogm.c +++ b/net/batman-adv/bat_v_ogm.c @@ -529,8 +529,10 @@ static void batadv_v_ogm_route_update(st goto out; } - if (router) + if (router) { batadv_neigh_node_put(router); + router = NULL; + } /* Update routes, and check if the OGM is from the best next hop */ batadv_v_ogm_orig_update(bat_priv, orig_node, neigh_node, ogm2, Patches currently in stable-queue which might be from a@unstable.cc are queue-4.6/batman-adv-fix-double-neigh_node_put-in-batadv_v_ogm_route_update.patch