releases/4.9.135/batman-adv-fix-segfault-when-writing-to-throughput_override.patch

   1 From foo@baz Thu Oct 18 11:11:32 CEST 2018
   2 From: Sven Eckelmann <sven@narfation.org>
   3 Date: Fri, 31 Aug 2018 16:46:47 +0200
   4 Subject: batman-adv: Fix segfault when writing to throughput_override
   5
   6 From: Sven Eckelmann <sven@narfation.org>
   7
   8 [ Upstream commit b9fd14c20871e6189f635e49b32d7789e430b3c8 ]
   9
  10 The per hardif sysfs file "batman_adv/throughput_override" prints the
  11 resulting change as info text when the users writes to this file. It uses
  12 the helper function batadv_info to add it at the same time to the kernel
  13 ring buffer and to the batman-adv debug log (when CONFIG_BATMAN_ADV_DEBUG
  14 is enabled).
  15
  16 The function batadv_info requires as first parameter the batman-adv softif
  17 net_device. This parameter is then used to find the private buffer which
  18 contains the debug log for this batman-adv interface. But
  19 batadv_store_throughput_override used as first argument the slave
  20 net_device. This slave device doesn't have the batadv_priv private data
  21 which is access by batadv_info.
  22
  23 Writing to this file with CONFIG_BATMAN_ADV_DEBUG enabled can either lead
  24 to a segfault or to memory corruption.
  25
  26 Fixes: 0b5ecc6811bd ("batman-adv: add throughput override attribute to hard_ifaces")
  27 Signed-off-by: Sven Eckelmann <sven@narfation.org>
  28 Acked-by: Marek Lindner <mareklindner@neomailbox.ch>
  29 Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
  30 Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
  31 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  32 ---
  33  net/batman-adv/sysfs.c |    5 +++--
  34  1 file changed, 3 insertions(+), 2 deletions(-)
  35
  36 --- a/net/batman-adv/sysfs.c
  37 +++ b/net/batman-adv/sysfs.c
  38 @@ -1084,8 +1084,9 @@ static ssize_t batadv_store_throughput_o
  39         if (old_tp_override == tp_override)
  40                 goto out;
  41
  42 -       batadv_info(net_dev, "%s: Changing from: %u.%u MBit to: %u.%u MBit\n",
  43 -                   "throughput_override",
  44 +       batadv_info(hard_iface->soft_iface,
  45 +                   "%s: %s: Changing from: %u.%u MBit to: %u.%u MBit\n",
  46 +                   "throughput_override", net_dev->name,
  47                     old_tp_override / 10, old_tp_override % 10,
  48                     tp_override / 10, tp_override % 10);
  49