batman-adv: Fix refcnt leak in batadv_v_neigh_*

The functions batadv_neigh_ifinfo_get increase the reference counter of the
batadv_neigh_ifinfo. These have to be reduced again when the reference is
not used anymore to correctly free the objects.

Fixes: 9786906022eb ("batman-adv: B.A.T.M.A.N. V - implement neighbor comparison API calls")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Antonio Quartulli <a@unstable.cc>

diff --git a/net/batman-adv/bat_v.c b/net/batman-adv/bat_v.c
index 50bfcf87f5691d4f63b4f2a44b0492a12663dee1..4f626a6b8ebdb45aa20a5ef4dd72b2823ac8c80a 100644 (file)
--- a/net/batman-adv/bat_v.c
+++ b/net/batman-adv/bat_v.c
@@ -256,14 +256,23 @@ static int batadv_v_neigh_cmp(struct batadv_neigh_node *neigh1,
                              struct batadv_hard_iface *if_outgoing2)
 {
        struct batadv_neigh_ifinfo *ifinfo1, *ifinfo2;
+       int ret = 0;
 
        ifinfo1 = batadv_neigh_ifinfo_get(neigh1, if_outgoing1);
+       if (WARN_ON(!ifinfo1))
+               goto err_ifinfo1;
+
        ifinfo2 = batadv_neigh_ifinfo_get(neigh2, if_outgoing2);
+       if (WARN_ON(!ifinfo2))
+               goto err_ifinfo2;
 
-       if (WARN_ON(!ifinfo1 || !ifinfo2))
-               return 0;
+       ret = ifinfo1->bat_v.throughput - ifinfo2->bat_v.throughput;
 
-       return ifinfo1->bat_v.throughput - ifinfo2->bat_v.throughput;
+       batadv_neigh_ifinfo_put(ifinfo2);
+err_ifinfo2:
+       batadv_neigh_ifinfo_put(ifinfo1);
+err_ifinfo1:
+       return ret;
 }
 
 static bool batadv_v_neigh_is_sob(struct batadv_neigh_node *neigh1,
@@ -273,17 +282,26 @@ static bool batadv_v_neigh_is_sob(struct batadv_neigh_node *neigh1,
 {
        struct batadv_neigh_ifinfo *ifinfo1, *ifinfo2;
        u32 threshold;
+       bool ret = false;
 
        ifinfo1 = batadv_neigh_ifinfo_get(neigh1, if_outgoing1);
-       ifinfo2 = batadv_neigh_ifinfo_get(neigh2, if_outgoing2);
+       if (WARN_ON(!ifinfo1))
+               goto err_ifinfo1;
 
-       if (WARN_ON(!ifinfo1 || !ifinfo2))
-               return false;
+       ifinfo2 = batadv_neigh_ifinfo_get(neigh2, if_outgoing2);
+       if (WARN_ON(!ifinfo2))
+               goto err_ifinfo2;
 
        threshold = ifinfo1->bat_v.throughput / 4;
        threshold = ifinfo1->bat_v.throughput - threshold;
 
-       return ifinfo2->bat_v.throughput > threshold;
+       ret = ifinfo2->bat_v.throughput > threshold;
+
+       batadv_neigh_ifinfo_put(ifinfo2);
+err_ifinfo2:
+       batadv_neigh_ifinfo_put(ifinfo1);
+err_ifinfo1:
+       return ret;
 }
 
 static struct batadv_algo_ops batadv_batman_v __read_mostly = {