Re: [PATCH 2/2] batman-adv: Improve exception handling in batadv_throw_uevent()

[Sven Eckelmann]

On Tuesday, 2 January 2024 08:12:56 CET Markus Elfring wrote:
> From: Markus Elfring 
> Date: Tue, 2 Jan 2024 07:52:21 +0100
> 
> The kfree() function was called in up to three cases by
> the batadv_throw_uevent() function during error handling
> even if the passed variable contained a null pointer.
> This issue was detected by using the Coccinelle software.
> 
> * Thus adjust jump targets.
> 
> * Reorder kfree() calls at the end.
> 
> Signed-off-by: Markus Elfring 

Acked-by: Sven Eckelmann 

> ---
>  net/batman-adv/main.c | 14 --
>  1 file changed, 8 insertions(+), 6 deletions(-)
> 
> diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
> index 5fc754b0b3f7..75119f1ffccc 100644
> --- a/net/batman-adv/main.c
> +++ b/net/batman-adv/main.c
> @@ -691,29 +691,31 @@ int batadv_throw_uevent(struct batadv_priv *bat_priv, 
> enum batadv_uev_type type,
> "%s%s", BATADV_UEV_TYPE_VAR,
> batadv_uev_type_str[type]);
>   if (!uevent_env[0])
> - goto out;
> + goto report_error;
> 
>   uevent_env[1] = kasprintf(GFP_ATOMIC,
> "%s%s", BATADV_UEV_ACTION_VAR,
> batadv_uev_action_str[action]);
>   if (!uevent_env[1])
> - goto out;
> + goto free_first_env;
> 
>   /* If the event is DEL, ignore the data field */
>   if (action != BATADV_UEV_DEL) {
>   uevent_env[2] = kasprintf(GFP_ATOMIC,
> "%s%s", BATADV_UEV_DATA_VAR, data);
>   if (!uevent_env[2])
> - goto out;
> + goto free_second_env;
>   }
> 
>   ret = kobject_uevent_env(bat_kobj, KOBJ_CHANGE, uevent_env);
> -out:
> - kfree(uevent_env[0]);
> - kfree(uevent_env[1]);
>   kfree(uevent_env[2]);
> +free_second_env:
> + kfree(uevent_env[1]);
> +free_first_env:
> + kfree(uevent_env[0]);
> 
>   if (ret)
> +report_error:
>   batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
>  "Impossible to send uevent for (%s,%s,%s) event 
> (err: %d)\n",
>  batadv_uev_type_str[type],
> --
> 2.43.0
> 
> 



signature.asc
Description: This is a digitally signed message part.

Re: [PATCH 1/2] batman-adv: Return directly after a failed batadv_dat_select_candidates() in batadv_dat_forward_data()

[Sven Eckelmann]

On Tuesday, 2 January 2024 08:11:47 CET Markus Elfring wrote:
> From: Markus Elfring 
> Date: Tue, 2 Jan 2024 07:27:45 +0100
> 
> The kfree() function was called in one case by
> the batadv_dat_forward_data() function during error handling
> even if the passed variable contained a null pointer.
> This issue was detected by using the Coccinelle software.
> 
> * Thus return directly after a batadv_dat_select_candidates() call failed
>   at the beginning.
> 
> * Delete the label “out” which became unnecessary with this refactoring.
> 
> Signed-off-by: Markus Elfring 

Acked-by: Sven Eckelmann 

> ---
>  net/batman-adv/distributed-arp-table.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/net/batman-adv/distributed-arp-table.c 
> b/net/batman-adv/distributed-arp-table.c
> index 28a939d56090..4c7e85534324 100644
> --- a/net/batman-adv/distributed-arp-table.c
> +++ b/net/batman-adv/distributed-arp-table.c
> @@ -684,7 +684,7 @@ static bool batadv_dat_forward_data(struct batadv_priv 
> *bat_priv,
> 
>   cand = batadv_dat_select_candidates(bat_priv, ip, vid);
>   if (!cand)
> - goto out;
> + return ret;
> 
>   batadv_dbg(BATADV_DBG_DAT, bat_priv, "DHT_SEND for %pI4\n", );
> 
> @@ -728,7 +728,6 @@ static bool batadv_dat_forward_data(struct batadv_priv 
> *bat_priv,
>   batadv_orig_node_put(cand[i].orig_node);
>   }
> 
> -out:
>   kfree(cand);
>   return ret;
>  }
> --
> 2.43.0
> 
> 



signature.asc
Description: This is a digitally signed message part.

[PATCH 2/2] batman-adv: Improve exception handling in batadv_throw_uevent()

[Markus Elfring]

From: Markus Elfring 
Date: Tue, 2 Jan 2024 07:52:21 +0100

The kfree() function was called in up to three cases by
the batadv_throw_uevent() function during error handling
even if the passed variable contained a null pointer.
This issue was detected by using the Coccinelle software.

* Thus adjust jump targets.

* Reorder kfree() calls at the end.

Signed-off-by: Markus Elfring 
---
 net/batman-adv/main.c | 14 --
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index 5fc754b0b3f7..75119f1ffccc 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -691,29 +691,31 @@ int batadv_throw_uevent(struct batadv_priv *bat_priv, 
enum batadv_uev_type type,
  "%s%s", BATADV_UEV_TYPE_VAR,
  batadv_uev_type_str[type]);
if (!uevent_env[0])
-   goto out;
+   goto report_error;

uevent_env[1] = kasprintf(GFP_ATOMIC,
  "%s%s", BATADV_UEV_ACTION_VAR,
  batadv_uev_action_str[action]);
if (!uevent_env[1])
-   goto out;
+   goto free_first_env;

/* If the event is DEL, ignore the data field */
if (action != BATADV_UEV_DEL) {
uevent_env[2] = kasprintf(GFP_ATOMIC,
  "%s%s", BATADV_UEV_DATA_VAR, data);
if (!uevent_env[2])
-   goto out;
+   goto free_second_env;
}

ret = kobject_uevent_env(bat_kobj, KOBJ_CHANGE, uevent_env);
-out:
-   kfree(uevent_env[0]);
-   kfree(uevent_env[1]);
kfree(uevent_env[2]);
+free_second_env:
+   kfree(uevent_env[1]);
+free_first_env:
+   kfree(uevent_env[0]);

if (ret)
+report_error:
batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
   "Impossible to send uevent for (%s,%s,%s) event 
(err: %d)\n",
   batadv_uev_type_str[type],
--
2.43.0

[PATCH 1/2] batman-adv: Return directly after a failed batadv_dat_select_candidates() in batadv_dat_forward_data()

[Markus Elfring]

From: Markus Elfring 
Date: Tue, 2 Jan 2024 07:27:45 +0100

The kfree() function was called in one case by
the batadv_dat_forward_data() function during error handling
even if the passed variable contained a null pointer.
This issue was detected by using the Coccinelle software.

* Thus return directly after a batadv_dat_select_candidates() call failed
  at the beginning.

* Delete the label “out” which became unnecessary with this refactoring.

Signed-off-by: Markus Elfring 
---
 net/batman-adv/distributed-arp-table.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/batman-adv/distributed-arp-table.c 
b/net/batman-adv/distributed-arp-table.c
index 28a939d56090..4c7e85534324 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -684,7 +684,7 @@ static bool batadv_dat_forward_data(struct batadv_priv 
*bat_priv,

cand = batadv_dat_select_candidates(bat_priv, ip, vid);
if (!cand)
-   goto out;
+   return ret;

batadv_dbg(BATADV_DBG_DAT, bat_priv, "DHT_SEND for %pI4\n", );

@@ -728,7 +728,6 @@ static bool batadv_dat_forward_data(struct batadv_priv 
*bat_priv,
batadv_orig_node_put(cand[i].orig_node);
}

-out:
kfree(cand);
return ret;
 }
--
2.43.0

[PATCH 0/2] batman-adv: Adjustments for two function implementations

[Markus Elfring]

From: Markus Elfring 
Date: Tue, 2 Jan 2024 08:02:01 +0100

A few update suggestions were taken into account
from static source code analysis.

Markus Elfring (2):
  Return directly after a failed batadv_dat_select_candidates()
in batadv_dat_forward_data()
  Improve exception handling in batadv_throw_uevent()

 net/batman-adv/distributed-arp-table.c |  3 +--
 net/batman-adv/main.c  | 14 --
 2 files changed, 9 insertions(+), 8 deletions(-)

--
2.43.0