batman-adv: fix NULL pointer dereferences

Was introduced with 4c8755d69cbde2ec464a39c932aed0a83f9ff89f
("batman-adv: Send multicast packets to nodes with a WANT_ALL flag")

Reported-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Acked-by: Antonio Quartulli <antonio@meshcoding.com>
Signed-off-by: Linus Lüssing <linus.luessing@web.de>
Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>

diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
index 8c7ca811de6e56589cabf2e8194af74ea87be278..96b66fd30f964021243b747db246d3db3574bc88 100644 (file)
--- a/net/batman-adv/multicast.c
+++ b/net/batman-adv/multicast.c
@@ -415,7 +415,7 @@ batadv_mcast_forw_ipv4_node_get(struct batadv_priv *bat_priv)
        hlist_for_each_entry_rcu(tmp_orig_node,
                                 &bat_priv->mcast.want_all_ipv4_list,
                                 mcast_want_all_ipv4_node) {
-               if (!atomic_inc_not_zero(&orig_node->refcount))
+               if (!atomic_inc_not_zero(&tmp_orig_node->refcount))
                        continue;
 
                orig_node = tmp_orig_node;
@@ -442,7 +442,7 @@ batadv_mcast_forw_ipv6_node_get(struct batadv_priv *bat_priv)
        hlist_for_each_entry_rcu(tmp_orig_node,
                                 &bat_priv->mcast.want_all_ipv6_list,
                                 mcast_want_all_ipv6_node) {
-               if (!atomic_inc_not_zero(&orig_node->refcount))
+               if (!atomic_inc_not_zero(&tmp_orig_node->refcount))
                        continue;
 
                orig_node = tmp_orig_node;
@@ -493,7 +493,7 @@ batadv_mcast_forw_unsnoop_node_get(struct batadv_priv *bat_priv)
        hlist_for_each_entry_rcu(tmp_orig_node,
                                 &bat_priv->mcast.want_all_unsnoopables_list,
                                 mcast_want_all_unsnoopables_node) {
-               if (!atomic_inc_not_zero(&orig_node->refcount))
+               if (!atomic_inc_not_zero(&tmp_orig_node->refcount))
                        continue;
 
                orig_node = tmp_orig_node;