Commit b1c1f23e authored by David S. Miller's avatar David S. Miller

Merge tag 'batman-adv-fix-for-davem' of git://git.open-mesh.org/linux-merge

Antonio Quartulli says:

====================
Included change:
- Fix invalid read while copying bat_iv.bcast_own by Sven Eckelmann
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 6757e6f5 13bbdd37
...@@ -185,7 +185,8 @@ static int batadv_iv_ogm_orig_add_if(struct batadv_orig_node *orig_node, ...@@ -185,7 +185,8 @@ static int batadv_iv_ogm_orig_add_if(struct batadv_orig_node *orig_node,
static int batadv_iv_ogm_orig_del_if(struct batadv_orig_node *orig_node, static int batadv_iv_ogm_orig_del_if(struct batadv_orig_node *orig_node,
int max_if_num, int del_if_num) int max_if_num, int del_if_num)
{ {
int chunk_size, ret = -ENOMEM, if_offset; int ret = -ENOMEM;
size_t chunk_size, if_offset;
void *data_ptr = NULL; void *data_ptr = NULL;
spin_lock_bh(&orig_node->bat_iv.ogm_cnt_lock); spin_lock_bh(&orig_node->bat_iv.ogm_cnt_lock);
...@@ -203,8 +204,9 @@ static int batadv_iv_ogm_orig_del_if(struct batadv_orig_node *orig_node, ...@@ -203,8 +204,9 @@ static int batadv_iv_ogm_orig_del_if(struct batadv_orig_node *orig_node,
memcpy(data_ptr, orig_node->bat_iv.bcast_own, del_if_num * chunk_size); memcpy(data_ptr, orig_node->bat_iv.bcast_own, del_if_num * chunk_size);
/* copy second part */ /* copy second part */
if_offset = (del_if_num + 1) * chunk_size;
memcpy((char *)data_ptr + del_if_num * chunk_size, memcpy((char *)data_ptr + del_if_num * chunk_size,
orig_node->bat_iv.bcast_own + ((del_if_num + 1) * chunk_size), (uint8_t *)orig_node->bat_iv.bcast_own + if_offset,
(max_if_num - del_if_num) * chunk_size); (max_if_num - del_if_num) * chunk_size);
free_bcast_own: free_bcast_own:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment