• Sven Eckelmann's avatar
    batman-adv: Avoid free/alloc race when handling OGM buffer · 40e220b4
    Sven Eckelmann authored
    Each slave interface of an B.A.T.M.A.N. IV virtual interface has an OGM
    packet buffer which is initialized using data from netdevice notifier and
    other rtnetlink related hooks. It is sent regularly via various slave
    interfaces of the batadv virtual interface and in this process also
    modified (realloced) to integrate additional state information via TVLV
    containers.
    
    It must be avoided that the worker item is executed without a common lock
    with the netdevice notifier/rtnetlink helpers. Otherwise it can either
    happen that half modified/freed data is sent out or functions modifying the
    OGM buffer try to access already freed memory regions.
    
    Reported-by: syzbot+0cc629f19ccb8534935b@syzkaller.appspotmail.com
    Fixes: c6c8fea2 ("net: Add batman-adv meshing protocol")
    Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
    Signed-off-by: default avatarSimon Wunderlich <sw@simonwunderlich.de>
    40e220b4
bat_iv_ogm.c 79.5 KB