diff options
| author | David S. Miller <davem@davemloft.net> | 2016-01-08 21:46:04 -0500 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2016-01-08 21:46:04 -0500 |
| commit | b1c1f23ef0c64fb7e54c5b44015640e068643023 (patch) | |
| tree | 5b50c46c472dc148225223c3ff4718dfe80694fb | |
| parent | 6757e6f5f44de32bc8cd0bb2dc800580380792db (diff) | |
| parent | 13bbdd370f67aef3351ad7bbc2fb624e3c23f905 (diff) | |
| download | linux-b1c1f23ef0c64fb7e54c5b44015640e068643023.tar.gz linux-b1c1f23ef0c64fb7e54c5b44015640e068643023.tar.bz2 linux-b1c1f23ef0c64fb7e54c5b44015640e068643023.zip | |
Merge tag 'batman-adv-fix-for-davem' of git://git.open-mesh.org/linux-merge
Antonio Quartulli says:
====================
Included change:
- Fix invalid read while copying bat_iv.bcast_own by Sven Eckelmann
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/batman-adv/bat_iv_ogm.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c index 912d9c36fb1c..aa94b4ec766a 100644 --- a/net/batman-adv/bat_iv_ogm.c +++ b/net/batman-adv/bat_iv_ogm.c @@ -185,7 +185,8 @@ unlock: static int batadv_iv_ogm_orig_del_if(struct batadv_orig_node *orig_node, int max_if_num, int del_if_num) { - int chunk_size, ret = -ENOMEM, if_offset; + int ret = -ENOMEM; + size_t chunk_size, if_offset; void *data_ptr = NULL; spin_lock_bh(&orig_node->bat_iv.ogm_cnt_lock); @@ -203,8 +204,9 @@ static int batadv_iv_ogm_orig_del_if(struct batadv_orig_node *orig_node, memcpy(data_ptr, orig_node->bat_iv.bcast_own, del_if_num * chunk_size); /* copy second part */ + if_offset = (del_if_num + 1) * chunk_size; memcpy((char *)data_ptr + del_if_num * chunk_size, - orig_node->bat_iv.bcast_own + ((del_if_num + 1) * chunk_size), + (uint8_t *)orig_node->bat_iv.bcast_own + if_offset, (max_if_num - del_if_num) * chunk_size); free_bcast_own: |