summaryrefslogtreecommitdiffstats
path: root/net/batman-adv
diff options
context:
space:
mode:
authorLinus Lüssing <linus.luessing@c0d3.blue>2024-01-17 06:22:20 +0100
committerSimon Wunderlich <sw@simonwunderlich.de>2024-01-27 09:13:39 +0100
commit0a186b49bba596b81de5a686ce5bfc9cd48ab3ef (patch)
tree8576a52697e5b4972d2c5e9576c1a99b3b7f9c56 /net/batman-adv
parentbatman-adv: mcast: fix mcast packet type counter on timeouted nodes (diff)
downloadlinux-0a186b49bba596b81de5a686ce5bfc9cd48ab3ef.tar.xz
linux-0a186b49bba596b81de5a686ce5bfc9cd48ab3ef.zip
batman-adv: mcast: fix memory leak on deleting a batman-adv interface
The batman-adv multicast tracker TVLV handler is registered for the new batman-adv multicast packet type upon creating a batman-adv interface, but not unregistered again upon the interface's deletion, leading to a memory leak. Fix this memory leak by calling the according TVLV handler unregister routine for the multicast tracker TVLV upon batman-adv interface deletion. Fixes: 07afe1ba288c ("batman-adv: mcast: implement multicast packet reception and forwarding") Reported-and-tested-by: syzbot+ebe64cc5950868e77358@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000beadc4060f0cbc23@google.com/ Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue> Signed-off-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Diffstat (limited to 'net/batman-adv')
-rw-r--r--net/batman-adv/multicast.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
index b4f8b4af1722..14088c4ff2f6 100644
--- a/net/batman-adv/multicast.c
+++ b/net/batman-adv/multicast.c
@@ -2175,6 +2175,7 @@ void batadv_mcast_free(struct batadv_priv *bat_priv)
cancel_delayed_work_sync(&bat_priv->mcast.work);
batadv_tvlv_container_unregister(bat_priv, BATADV_TVLV_MCAST, 2);
+ batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_MCAST_TRACKER, 1);
batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_MCAST, 2);
/* safely calling outside of worker, as worker was canceled above */