This is a note to let you know that I've just added the patch titled
batman-adv: release vlan object after checking the CRC
to the 3.13-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
batman-adv-release-vlan-object-after-checking-the-crc.patch
and it can be found in the queue-3.13 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From foo@baz Thu Feb 27 20:11:26 PST 2014
From: Antonio Quartulli <antonio@xxxxxxxxxxxxxx>
Date: Tue, 28 Jan 2014 02:06:47 +0100
Subject: batman-adv: release vlan object after checking the CRC
From: Antonio Quartulli <antonio@xxxxxxxxxxxxxx>
[ Upstream commit 91c2b1a9f680ff105369d49abc7e19ca7efb33e1 ]
There is a refcounter unbalance in the CRC checking routine
invoked on OGM reception. A vlan object is retrieved (thus
its refcounter is increased by one) but it is never properly
released. This leads to a memleak because the vlan object
will never be free'd.
Fix this by releasing the vlan object after having read the
CRC.
Reported-by: Russell Senior <russell@xxxxxxxxxxxxxxxxx>
Reported-by: Daniel <daniel@xxxxxxxxxxxxxx>
Reported-by: cmsv <cmsv@xxxxxxxxxxxxxx>
Signed-off-by: Antonio Quartulli <antonio@xxxxxxxxxxxxxx>
Signed-off-by: Marek Lindner <mareklindner@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/batman-adv/translation-table.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -2248,6 +2248,7 @@ static bool batadv_tt_global_check_crc(s
{
struct batadv_tvlv_tt_vlan_data *tt_vlan_tmp;
struct batadv_orig_node_vlan *vlan;
+ uint32_t crc;
int i;
/* check if each received CRC matches the locally stored one */
@@ -2267,7 +2268,10 @@ static bool batadv_tt_global_check_crc(s
if (!vlan)
return false;
- if (vlan->tt.crc != ntohl(tt_vlan_tmp->crc))
+ crc = vlan->tt.crc;
+ batadv_orig_node_vlan_free_ref(vlan);
+
+ if (crc != ntohl(tt_vlan_tmp->crc))
return false;
}
Patches currently in stable-queue which might be from antonio@xxxxxxxxxxxxxx are
queue-3.13/batman-adv-fix-soft-interface-mtu-computation.patch
queue-3.13/batman-adv-avoid-double-free-when-orig_node-initialization-fails.patch
queue-3.13/batman-adv-fix-potential-orig_node-reference-leak.patch
queue-3.13/batman-adv-release-vlan-object-after-checking-the-crc.patch
queue-3.13/batman-adv-fix-potential-kernel-paging-error-for-unicast-transmissions.patch
queue-3.13/batman-adv-properly-check-pskb_may_pull-return-value.patch
queue-3.13/batman-adv-fix-tt-tvlv-parsing-on-ogm-reception.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html