diff mbox series

[maint,1/2] batman-adv: fix backbone_gw refcount on queue_work() failure

Message ID 20180906214555.12272-1-mareklindner@neomailbox.ch (mailing list archive)
State Accepted, archived
Commit 24d83a50421c1c5d39cd9c015516a1a293ae8d0c
Delegated to: Simon Wunderlich
Headers
Series [maint,1/2] batman-adv: fix backbone_gw refcount on queue_work() failure |

Commit Message

Marek Lindner Sept. 6, 2018, 9:45 p.m. UTC 
  The backbone_gw refcounter is to be decreased by the queued work and
currently is never decreased if the queue_work() call fails.
Fix by checking the queue_work() return value and decrease refcount
if necessary.

Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
---
 net/batman-adv/bridge_loop_avoidance.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

Comments

Sven Eckelmann Sept. 7, 2018, 11:17 a.m. UTC | #1 
On Donnerstag, 6. September 2018 23:45:54 CEST Marek Lindner wrote:
> The backbone_gw refcounter is to be decreased by the queued work and
> currently is never decreased if the queue_work() call fails.
> Fix by checking the queue_work() return value and decrease refcount
> if necessary.
> 
> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
> ---
>  net/batman-adv/bridge_loop_avoidance.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)

Added both patches as 24d83a50421c [1] and 85100b602c12 [2]

Thanks,
	Sven

[1] https://git.open-mesh.org/batman-adv.git/commit/24d83a50421c1c5d39cd9c015516a1a293ae8d0c
[2] https://git.open-mesh.org/batman-adv.git/commit/85100b602c127cecf1bcfd620d20eb867d685df2
diff mbox series

Patch

diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index a2de5a44..58c093ca 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -1772,6 +1772,7 @@  batadv_bla_loopdetect_check(struct batadv_priv *bat_priv, struct sk_buff *skb,
 {
 	struct batadv_bla_backbone_gw *backbone_gw;
 	struct ethhdr *ethhdr;
+	bool ret;
 
 	ethhdr = eth_hdr(skb);
 
@@ -1795,8 +1796,13 @@  batadv_bla_loopdetect_check(struct batadv_priv *bat_priv, struct sk_buff *skb,
 	if (unlikely(!backbone_gw))
 		return true;
 
-	queue_work(batadv_event_workqueue, &backbone_gw->report_work);
-	/* backbone_gw is unreferenced in the report work function function */
+	ret = queue_work(batadv_event_workqueue, &backbone_gw->report_work);
+
+	/* backbone_gw is unreferenced in the report work function function
+	 * if queue_work() call was successful
+	 */
+	if (!ret)
+		batadv_backbone_gw_put(backbone_gw);
 
 	return true;
 }