Logic bug in B.A.T.M.A.N. advanced driver

Logic bug in B.A.T.M.A.N. advanced driver

[Thomas Jarosch]

Hi Marek,

Consider this code from "net/batman-adv/bitarray.c":

int bit_get_packet(void *priv, unsigned long *seq_bits,
		    int32_t seq_num_diff, int set_mark)
{
        ...

	if ((seq_num_diff >= TQ_LOCAL_WINDOW_SIZE)
		|| (seq_num_diff < EXPECTED_SEQNO_RANGE)) {
		bat_dbg(DBG_BATMAN, bat_priv,
			"We missed a lot of packets (%i) !\n",
			seq_num_diff - 1);
		bit_reset_window(seq_bits);
		if (set_mark)
			bit_mark(seq_bits, 0);
		return 1;
	}
-----------------------------------

The defines from "main.h":
#define TQ_LOCAL_WINDOW_SIZE 64
#define EXPECTED_SEQNO_RANGE	65536


So that if() statement will translate to:

-----------------------------------
	if ((seq_num_diff >= 64)
		|| (seq_num_diff < 65536)) {
-----------------------------------

and this will always evaluate to true.

Detected by "cppcheck":
"[net/batman-adv/bitarray.c:157]: (warning) Mutual exclusion over ||
always evaluates to true. Did you intend to use && instead?"

Cheers,
Thomas

[PATCH] batman-adv: Fix range check for expected packets

[Simon Wunderlich]

The check for new packets in the future used a wrong binary operator,
which makes the check expression always true and accepting too many
packets.

Reported-by: Thomas Jarosch <thomas.jarosch-XXsH3GEs1jrby3iVrkZq2A@public.gmane.org>
Signed-off-by: Simon Wunderlich <siwu-MaAgPAbsBIVS8oHt8HbXEIQuADTiUCJX@public.gmane.org>
---
 bitarray.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/bitarray.c b/bitarray.c
index 0be9ff3..9bc63b2 100644
--- a/bitarray.c
+++ b/bitarray.c
@@ -155,7 +155,7 @@ int bit_get_packet(void *priv, unsigned long *seq_bits,
 	/* sequence number is much newer, probably missed a lot of packets */
 
 	if ((seq_num_diff >= TQ_LOCAL_WINDOW_SIZE)
-		|| (seq_num_diff < EXPECTED_SEQNO_RANGE)) {
+		&& (seq_num_diff < EXPECTED_SEQNO_RANGE)) {
 		bat_dbg(DBG_BATMAN, bat_priv,
 			"We missed a lot of packets (%i) !\n",
 			seq_num_diff - 1);
-- 
1.7.7

Re: [PATCH] batman-adv: Fix range check for expected packets

[Marek Lindner]

On Sunday, October 30, 2011 16:22:43 Simon Wunderlich wrote:
> The check for new packets in the future used a wrong binary operator,
> which makes the check expression always true and accepting too many
> packets.

Applied in revision 00ca20e.

Thanks,
Marek