batman-adv: Fix double neigh_node_put in batadv_v_ogm_route_update
commitf38db9379af750cf0d6ecf957af129100dc62a9e
authorSven Eckelmann <sven@narfation.org>
Sat, 21 May 2016 09:48:17 +0000 (21 17:48 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 8 Jun 2016 01:23:39 +0000 (7 18:23 -0700)
treef1372fc2eb7f4b04db992e0d2f0b31ac8bdcc272
parent1c291d3adad88eb74a5d9a38a75266bfb527bfa2
batman-adv: Fix double neigh_node_put in batadv_v_ogm_route_update

The router is put down twice when it was non-NULL and either orig_ifinfo is
NULL afterwards or batman-adv receives a packet with the same sequence
number. This will end up in a use-after-free when the batadv_neigh_node is
removed because the reference counter ended up too early at 0.

This patch is skipping netdev and is being sent directly to stable in
accordance with David S. Miller[1].

The reason is that this patch applies only on linux-4.6 and not on
linux-4.7/net because it was "accidentally" fixed by a refactoring
commit (more details in [2]).

It addresses a reference imbalance which systematically leads to a
use-after-free and then a kernel crash.

[1] https://www.mail-archive.com/b.a.t.m.a.n@lists.open-mesh.org/msg15258.html
[2] https://www.mail-archive.com/b.a.t.m.a.n@lists.open-mesh.org/msg15252.html

Fixes: 9323158ef9f4 ("batman-adv: OGMv2 - implement originators logic")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Antonio Quartulli <a@unstable.cc>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/batman-adv/bat_v_ogm.c