]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit
batman-adv: Avoid free/alloc race when handling OGM2 buffer
authorSven Eckelmann <sven@narfation.org>
Mon, 16 Mar 2020 22:30:30 +0000 (23:30 +0100)
committerKleber Sacilotto de Souza <kleber.souza@canonical.com>
Tue, 7 Apr 2020 08:52:03 +0000 (10:52 +0200)
commitcbfd1baada106e0ca7a7a19056d1dee23993624c
tree7554fb31117d821a15bd083f335a8f0d73de724f
parent3115c65fe09d218b6c66bb501e8e67cf144c9812
batman-adv: Avoid free/alloc race when handling OGM2 buffer

BugLink: https://bugs.launchpad.net/bugs/1869732
commit a8d23cbbf6c9f515ed678204ad2962be7c336344 upstream.

A B.A.T.M.A.N. V virtual interface has an OGM2 packet buffer which is
initialized using data from the netdevice notifier and other rtnetlink
related hooks. It is sent regularly via various slave interfaces of the
batadv virtual interface and in this process also modified (realloced) to
integrate additional state information via TVLV containers.

It must be avoided that the worker item is executed without a common lock
with the netdevice notifier/rtnetlink helpers. Otherwise it can either
happen that half modified data is sent out or the functions modifying the
OGM2 buffer try to access already freed memory regions.

Fixes: 0da0035942d4 ("batman-adv: OGMv2 - add basic infrastructure")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>
net/batman-adv/bat_v_ogm.c
net/batman-adv/types.h