diff options
| author | Sven Eckelmann <sven@narfation.org> | 2019-10-03 17:02:01 +0200 |
|---|---|---|
| committer | Simon Wunderlich <sw@simonwunderlich.de> | 2019-10-13 21:00:07 +0200 |
| commit | 40e220b4218bb3d278e5e8cc04ccdfd1c7ff8307 (patch) | |
| tree | ba826ec7b04c7b73e9ac8c2858cb4da9ce018605 /net/batman-adv/types.h | |
| parent | a8d23cbbf6c9f515ed678204ad2962be7c336344 (diff) | |
batman-adv: Avoid free/alloc race when handling OGM buffer
Each slave interface of an B.A.T.M.A.N. IV virtual interface has an OGM
packet buffer which is initialized using data from netdevice notifier and
other rtnetlink related hooks. It is sent regularly via various slave
interfaces of the batadv virtual interface and in this process also
modified (realloced) to integrate additional state information via TVLV
containers.
It must be avoided that the worker item is executed without a common lock
with the netdevice notifier/rtnetlink helpers. Otherwise it can either
happen that half modified/freed data is sent out or functions modifying the
OGM buffer try to access already freed memory regions.
Reported-by: syzbot+0cc629f19ccb8534935b@syzkaller.appspotmail.com
Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Diffstat (limited to 'net/batman-adv/types.h')
| -rw-r--r-- | net/batman-adv/types.h | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h index a9fb7b17f557..4d7f1baee7b7 100644 --- a/net/batman-adv/types.h +++ b/net/batman-adv/types.h @@ -82,6 +82,9 @@ struct batadv_hard_iface_bat_iv { /** @ogm_seqno: OGM sequence number - used to identify each OGM */ atomic_t ogm_seqno; + + /** @ogm_buff_mutex: lock protecting ogm_buff and ogm_buff_len */ + struct mutex ogm_buff_mutex; }; /** |