netdev - [PATCH net v2] batman-adv: fix for leaked TVLV handler.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 24 May 2019 10:59:27 +0100
From:   Jeremy Sowden <jeremy@...zel.net>
To:     b.a.t.m.a.n@...ts.open-mesh.org, netdev@...r.kernel.org,
        Marek Lindner <mareklindner@...mailbox.ch>,
        Simon Wunderlich <sw@...onwunderlich.de>,
        Antonio Quartulli <a@...table.cc>,
        "David S. Miller" <davem@...emloft.net>
Cc:     syzbot+d454a826e670502484b8@...kaller.appspotmail.com,
        Sven Eckelmann <sven@...fation.org>
Subject: [PATCH net v2] batman-adv: fix for leaked TVLV handler.

A handler for BATADV_TVLV_ROAM was being registered when the
translation-table was initialized, but not unregistered when the
translation-table was freed.  Unregister it.

Fixes: 122edaa05940 ("batman-adv: tvlv - convert roaming adv packet to use tvlv unicast packets")
Reported-by: syzbot+d454a826e670502484b8@...kaller.appspotmail.com
Reviewed-by: Sven Eckelmann <sven@...fation.org>
Signed-off-by: Jeremy Sowden <jeremy@...zel.net>
---
Since v1.

  * Added "Fixes:" tag.
  * Added "Reviewed-by:" tag.
  * Changed prefix to "batman-adv:".

 net/batman-adv/translation-table.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 1ddfd5e011ee..8a482c5ec67b 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -3813,6 +3813,8 @@ static void batadv_tt_purge(struct work_struct *work)
  */
 void batadv_tt_free(struct batadv_priv *bat_priv)
 {
+	batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_ROAM, 1);
+
 	batadv_tvlv_container_unregister(bat_priv, BATADV_TVLV_TT, 1);
 	batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_TT, 1);
 
-- 
2.20.1