queue-5.10/batman-adv-improve-exception-handling-in-batadv_thro.patch

   1 From f21c3a842cbe852e4e3e703adf28c928de47e26f Mon Sep 17 00:00:00 2001
   2 From: Sasha Levin <sashal@kernel.org>
   3 Date: Tue, 2 Jan 2024 07:52:21 +0100
   4 Subject: batman-adv: Improve exception handling in batadv_throw_uevent()
   5
   6 From: Markus Elfring <elfring@users.sourceforge.net>
   7
   8 [ Upstream commit 5593e9abf1cf2bf096366d8c7fd933bc69d561ce ]
   9
  10 The kfree() function was called in up to three cases by
  11 the batadv_throw_uevent() function during error handling
  12 even if the passed variable contained a null pointer.
  13 This issue was detected by using the Coccinelle software.
  14
  15 * Thus adjust jump targets.
  16
  17 * Reorder kfree() calls at the end.
  18
  19 Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
  20 Acked-by: Sven Eckelmann <sven@narfation.org>
  21 Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
  22 Signed-off-by: Sasha Levin <sashal@kernel.org>
  23 ---
  24  net/batman-adv/main.c | 14 ++++++++------
  25  1 file changed, 8 insertions(+), 6 deletions(-)
  26
  27 diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
  28 index 9f267b190779f..ac3ebdba83040 100644
  29 --- a/net/batman-adv/main.c
  30 +++ b/net/batman-adv/main.c
  31 @@ -732,29 +732,31 @@ int batadv_throw_uevent(struct batadv_priv *bat_priv, enum batadv_uev_type type,
  32                                   "%s%s", BATADV_UEV_TYPE_VAR,
  33                                   batadv_uev_type_str[type]);
  34         if (!uevent_env[0])
  35 -               goto out;
  36 +               goto report_error;
  37
  38         uevent_env[1] = kasprintf(GFP_ATOMIC,
  39                                   "%s%s", BATADV_UEV_ACTION_VAR,
  40                                   batadv_uev_action_str[action]);
  41         if (!uevent_env[1])
  42 -               goto out;
  43 +               goto free_first_env;
  44
  45         /* If the event is DEL, ignore the data field */
  46         if (action != BATADV_UEV_DEL) {
  47                 uevent_env[2] = kasprintf(GFP_ATOMIC,
  48                                           "%s%s", BATADV_UEV_DATA_VAR, data);
  49                 if (!uevent_env[2])
  50 -                       goto out;
  51 +                       goto free_second_env;
  52         }
  53
  54         ret = kobject_uevent_env(bat_kobj, KOBJ_CHANGE, uevent_env);
  55 -out:
  56 -       kfree(uevent_env[0]);
  57 -       kfree(uevent_env[1]);
  58         kfree(uevent_env[2]);
  59 +free_second_env:
  60 +       kfree(uevent_env[1]);
  61 +free_first_env:
  62 +       kfree(uevent_env[0]);
  63
  64         if (ret)
  65 +report_error:
  66                 batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
  67                            "Impossible to send uevent for (%s,%s,%s) event (err: %d)\n",
  68                            batadv_uev_type_str[type],
  69 --
  70 2.43.0
  71