Re: [B.A.T.M.A.N.] [PATCH maint] batman-adv: Fix double neigh_node_put in batadv_v_ogm_route_update

[Marek Lindner <mareklindner@neomailbox.ch>]

[-- Attachment #1: Type: text/plain, Size: 905 bytes --]

On Friday, May 06, 2016 22:27:09 Sven Eckelmann wrote:
> The router is put down twice when it was non-NULL and either orig_ifinfo is
> NULL afterwards or batman-adv receives a packet with the same sequence
> number. This will end up in a use-after-free when the batadv_neigh_node is
> removed because the reference counter ended up too early at 0.
> 
> Fixes: 667996ebeab4 ("batman-adv: OGMv2 - implement originators logic")
> Signed-off-by: Sven Eckelmann <sven@narfation.org>
> ---
> It looks like this bug was solved in next/master by refactoring in
> 30c96bc7870f ("batman-adv: move and restructure batadv_v_ogm_forward")
> 
> only compile tested. Please add so many reported by as you want - 
> just don't know it it is *the* bug and who actually reported it.
> ---
>  net/batman-adv/bat_v_ogm.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

Applied in revision fc3e79d.

Thanks,
Marek

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 473 bytes --]