[B.A.T.M.A.N.] [PATCHv3 maint] batman-adv: fix kernel crash due to missing NULL checks

[B.A.T.M.A.N.] [PATCHv3 maint] batman-adv: fix kernel crash due to missing NULL checks

[Marek Lindner]

batadv_softif_vlan_get() may return NULL which has to be verified
by the caller.

Fixes: 9729d20 ("batman-adv: fix TT VLAN inconsistency on VLAN re-add")

Reported-by: Ryan Thompson <ryan@eero.com>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
---
v3: moved WARN() into if expression
v2: added WARN() in batadv_tt_local_add()

 soft-interface.c    |  3 +++
 translation-table.c | 18 ++++++++++++++----
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/soft-interface.c b/soft-interface.c
index da89336..7841a4b 100644
--- a/soft-interface.c
+++ b/soft-interface.c
@@ -455,6 +455,9 @@ out:
  */
 void batadv_softif_vlan_free_ref(struct batadv_softif_vlan *vlan)
 {
+	if (!vlan)
+		return;
+
 	if (atomic_dec_and_test(&vlan->refcount)) {
 		spin_lock_bh(&vlan->bat_priv->softif_vlan_list_lock);
 		hlist_del_rcu(&vlan->list);
diff --git a/translation-table.c b/translation-table.c
index e95a424..f56b847 100644
--- a/translation-table.c
+++ b/translation-table.c
@@ -575,6 +575,9 @@ bool batadv_tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
 
 	/* increase the refcounter of the related vlan */
 	vlan = batadv_softif_vlan_get(bat_priv, vid);
+	if (WARN(!vlan, "adding TT local entry %pM to non-existent VLAN %d",
+		 addr, BATADV_PRINT_VID(vid)))
+		goto out;
 
 	batadv_dbg(BATADV_DBG_TT, bat_priv,
 		   "Creating new local tt entry: %pM (vid: %d, ttvn: %d)\n",
@@ -1047,6 +1050,9 @@ uint16_t batadv_tt_local_remove(struct batadv_priv *bat_priv,
 
 	/* decrease the reference held for this vlan */
 	vlan = batadv_softif_vlan_get(bat_priv, vid);
+	if (!vlan)
+		goto out;
+
 	batadv_softif_vlan_free_ref(vlan);
 	batadv_softif_vlan_free_ref(vlan);
 
@@ -1147,8 +1153,10 @@ static void batadv_tt_local_table_free(struct batadv_priv *bat_priv)
 			/* decrease the reference held for this vlan */
 			vlan = batadv_softif_vlan_get(bat_priv,
 						      tt_common_entry->vid);
-			batadv_softif_vlan_free_ref(vlan);
-			batadv_softif_vlan_free_ref(vlan);
+			if (vlan) {
+				batadv_softif_vlan_free_ref(vlan);
+				batadv_softif_vlan_free_ref(vlan);
+			}
 
 			batadv_tt_local_entry_free_ref(tt_local);
 		}
@@ -3188,8 +3196,10 @@ static void batadv_tt_local_purge_pending_clients(struct batadv_priv *bat_priv)
 
 			/* decrease the reference held for this vlan */
 			vlan = batadv_softif_vlan_get(bat_priv, tt_common->vid);
-			batadv_softif_vlan_free_ref(vlan);
-			batadv_softif_vlan_free_ref(vlan);
+			if (vlan) {
+				batadv_softif_vlan_free_ref(vlan);
+				batadv_softif_vlan_free_ref(vlan);
+			}
 
 			batadv_tt_local_entry_free_ref(tt_local);
 		}
-- 
2.1.4

Re: [B.A.T.M.A.N.] [PATCHv3 maint] batman-adv: fix kernel crash due to missing NULL checks

[Antonio Quartulli]

[-- Attachment #1: Type: text/plain, Size: 410 bytes --]



On 19/06/15 09:16, Marek Lindner wrote:
> batadv_softif_vlan_get() may return NULL which has to be verified
> by the caller.
> 
> Fixes: 9729d20 ("batman-adv: fix TT VLAN inconsistency on VLAN re-add")
> 
> Reported-by: Ryan Thompson <ryan@eero.com>
> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>

Acked-by: Antonio Quartulli <antonio@meshcoding.com>



-- 
Antonio Quartulli


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [B.A.T.M.A.N.] [PATCHv3 maint] batman-adv: fix kernel crash due to missing NULL checks

[Marek Lindner]

[-- Attachment #1: Type: text/plain, Size: 557 bytes --]

On Friday, June 19, 2015 10:43:37 Antonio Quartulli wrote:
> Signed by antonio@meshcoding.com.	Show Details
> 
> On 19/06/15 09:16, Marek Lindner wrote:
> > batadv_softif_vlan_get() may return NULL which has to be verified
> > by the caller.
> >
> > 
> >
> > Fixes: 9729d20 ("batman-adv: fix TT VLAN inconsistency on VLAN re-add")
> >
> > 
> >
> > Reported-by: Ryan Thompson <ryan@eero.com>
> > Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
> 
> Acked-by: Antonio Quartulli <antonio@meshcoding.com>

Applied in revision 2c2dfd8.

Regards,
Marek

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 473 bytes --]