linux-toradex.git/net/batman-adv/icmp_socket.c, branch v3.3-rc2

batman-adv: Only write requested number of byte to user buffer

2011-12-12T11:11:07+00:00

Don't write more than the requested number of bytes of an batman-adv icmp
packet to the userspace buffer. Otherwise unrelated userspace memory might get
overridden by the kernel.

Signed-off-by: Sven Eckelmann 
Signed-off-by: Marek Lindner

batman-adv: Directly check read of icmp packet in copy_from_user

2011-12-12T11:11:06+00:00

The access_ok read check can be directly done in copy_from_user since a failure
of access_ok is handled the same way as an error in __copy_from_user.

Signed-off-by: Sven Eckelmann 
Signed-off-by: Marek Lindner

batman-adv: bat_socket_read missing checks

2011-12-12T11:11:06+00:00

Writing a icmp_packet_rr and then reading icmp_packet can lead to kernel
memory corruption, if __user *buf is just below TASK_SIZE.

Signed-off-by: Paul Kot 
[sven@narfation.org: made it checkpatch clean]
Signed-off-by: Sven Eckelmann 
Signed-off-by: Marek Lindner

batman-adv: report compat_version in version field in case of version mismatch

2011-11-20T12:08:35+00:00

Reported-by: Sven Eckelmann 
Signed-off-by: Marek Lindner 
Signed-off-by: Sven Eckelmann

batman-adv: Calculate sizeof using variable insead of types

2011-05-30T05:39:33+00:00

Documentation/CodingStyle recommends to use the form

	p = kmalloc(sizeof(*p), ...);

to calculate the size of a struct and not the version where the struct
name is spelled out to prevent bugs when the type of p changes. This
also seems appropriate for manipulation of buffers when they are
directly associated with p.

Signed-off-by: Sven Eckelmann

batman-adv: Make bat_priv->primary_if an rcu protected pointer

2011-05-01T20:49:03+00:00

The rcu protected macros rcu_dereference() and rcu_assign_pointer()
for the bat_priv->primary_if need to be used, as well as spin/rcu locking.

Otherwise we might end up using a primary_if pointer pointing to already
freed memory.

Signed-off-by: Marek Lindner 
Signed-off-by: Sven Eckelmann

batman-adv: Make orig_node->router an rcu protected pointer

2011-04-17T19:11:01+00:00

The rcu protected macros rcu_dereference() and rcu_assign_pointer()
for the orig_node->router need to be used, as well as spin/rcu locking.
Otherwise we might end up using a router pointer pointing to already
freed memory.

Therefore this commit introduces the safe getter method
orig_node_get_router().

Signed-off-by: Linus Lüssing 
Signed-off-by: Marek Lindner 
Signed-off-by: Sven Eckelmann

batman-adv: remove orig_hash spinlock

2011-03-05T11:52:04+00:00

Signed-off-by: Marek Lindner

batman-adv: Correct rcu refcounting for orig_node

2011-03-05T11:52:01+00:00

It might be possible that 2 threads access the same data in the same
rcu grace period. The first thread calls call_rcu() to decrement the
refcount and free the data while the second thread increases the
refcount to use the data. To avoid this race condition all refcount
operations have to be atomic.

Reported-by: Sven Eckelmann 
Signed-off-by: Marek Lindner

batman-adv: remove extra layer between hash and hash element - hash bucket

2011-03-05T11:52:00+00:00

Signed-off-by: Marek Lindner