olsrd: initialize the LQ multiplier list pointer in the ubus handler

The ubus add_interface handler allocates a struct olsr_lq_mult with
malloc() and assigns only ->addr and ->value, leaving ->next
uninitialized before the node is published into cnf->lq_mult. olsrd
walks that list with

    for (mult = cnf->lq_mult; mult != NULL; mult = mult->next)

so the first traversal follows an indeterminate pointer.

Chain the new node onto the existing list, which is what the
configuration file parser does for LinkQualityMult in
src/cfgparser/oparse.y. This also makes the orig_lq_mult_cnt++ on
the next line consistent, since the entry really is prepended to the
list instead of replacing it.

Reported-by: openwrt-ai[bot]
Signed-off-by: Josef Schlehofer <redacted>
Co-authored-by: Claude Fable 5 <redacted>

diff --git a/net/olsrd/src/src/ubus.c b/net/olsrd/src/src/ubus.c
index 37c2dbf99d1c188c200deaab59b1b58f8bf8d789..88caed13c418f56473cebd67ae86d51056d9a63a 100644 (file)
--- a/net/olsrd/src/src/ubus.c
+++ b/net/olsrd/src/src/ubus.c
@@ -83,6 +83,7 @@ static int olsrd_ubus_add_interface(struct ubus_context *ctx_local,
     double lqm_value = atof(lqm);
     mult->addr = addr;
     mult->value = (uint32_t)(lqm_value * LINK_LOSS_MULTIPLIER);
+    mult->next = tmp_ifs->cnf->lq_mult;
     tmp_ifs->cnf->lq_mult = mult;
     tmp_ifs->cnf->orig_lq_mult_cnt++;
   }