Re: [B.A.T.M.A.N.] [PATCHv3 4/6] batman-adv: drop unicast packets from other backbone gw

[Sven Eckelmann <sven@narfation.org>]

[-- Attachment #1: Type: text/plain, Size: 1491 bytes --]

On Friday 06 May 2016 10:58:25 Andreas Pape wrote:
[...]
> +		/* If this is a unicast packet from another backgone gw,
> +		 * drop it.
> +		 */
> +		orig_addr = ethhdr->h_source;
> +		orig_node = batadv_orig_hash_find(bat_priv, orig_addr);

I think we already told this before: This is overwriting the previous
orig_node without freeing the reference. It most likely has also other weird
consequences. Here is the relevant code to better understand what it
overwrites:

		if (is4addr) {
			subtype = unicast_4addr_packet->subtype;
			batadv_dat_inc_counter(bat_priv, subtype);

			/* Only payload data should be considered for speedy
			 * join. For example, DAT also uses unicast 4addr
			 * types, but those packets should not be considered
			 * for speedy join, since the clients do not actually
			 * reside at the sending originator.
			 */
			if (subtype == BATADV_P_DATA) {
				orig_addr = unicast_4addr_packet->src;
				orig_node = batadv_orig_hash_find(bat_priv,
								  orig_addr);
			}
		}

		/* If this is a unicast packet from another backgone gw,
		 * drop it.
		 */
		orig_addr = ethhdr->h_source;
		orig_node = batadv_orig_hash_find(bat_priv, orig_addr);
		if (orig_node &&
		    batadv_bla_is_backbone_gw(skb, orig_node, hdr_size)) {
			batadv_dbg(BATADV_DBG_BLA, bat_priv,
				   "recv_unicast_packet(): Dropped unicast pkt received from another backbone gw %pM.\n",
				   orig_addr);
			batadv_orig_node_put(orig_node);
			return NET_RX_DROP;
		}

Kind regards,
	Sven

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 819 bytes --]