summaryrefslogtreecommitdiff
path: root/net/batman-adv/translation-table.c
diff options
context:
space:
mode:
authorAntonio Quartulli <antonio@meshcoding.com>2014-01-28 05:06:47 +0400
committerAntonio Quartulli <antonio@meshcoding.com>2014-02-17 20:17:00 +0400
commit91c2b1a9f680ff105369d49abc7e19ca7efb33e1 (patch)
treed5449f16cab7d66c710acbfe16d036282d41adfc /net/batman-adv/translation-table.c
parente889241f45f9cecbc84a6ffed577083ab52e62ee (diff)
downloadlinux-91c2b1a9f680ff105369d49abc7e19ca7efb33e1.tar.xz
batman-adv: release vlan object after checking the CRC
There is a refcounter unbalance in the CRC checking routine invoked on OGM reception. A vlan object is retrieved (thus its refcounter is increased by one) but it is never properly released. This leads to a memleak because the vlan object will never be free'd. Fix this by releasing the vlan object after having read the CRC. Reported-by: Russell Senior <russell@personaltelco.net> Reported-by: Daniel <daniel@makrotopia.org> Reported-by: cmsv <cmsv@wirelesspt.net> Signed-off-by: Antonio Quartulli <antonio@meshcoding.com> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Diffstat (limited to 'net/batman-adv/translation-table.c')
-rw-r--r--net/batman-adv/translation-table.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index beba13fbd10a..c21c5572c860 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -2262,6 +2262,7 @@ static bool batadv_tt_global_check_crc(struct batadv_orig_node *orig_node,
{
struct batadv_tvlv_tt_vlan_data *tt_vlan_tmp;
struct batadv_orig_node_vlan *vlan;
+ uint32_t crc;
int i;
/* check if each received CRC matches the locally stored one */
@@ -2281,7 +2282,10 @@ static bool batadv_tt_global_check_crc(struct batadv_orig_node *orig_node,
if (!vlan)
return false;
- if (vlan->tt.crc != ntohl(tt_vlan_tmp->crc))
+ crc = vlan->tt.crc;
+ batadv_orig_node_vlan_free_ref(vlan);
+
+ if (crc != ntohl(tt_vlan_tmp->crc))
return false;
}