From patchwork Sat Mar 5 15:09:17 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sven Eckelmann X-Patchwork-Id: 15891 X-Patchwork-Delegate: mareklindner@neomailbox.ch Return-Path: X-Original-To: patchwork@open-mesh.org Delivered-To: patchwork@open-mesh.org Received: from open-mesh.org (localhost [127.0.0.1]) by open-mesh.org (Postfix) with ESMTP id 57C68823F1; Sat, 5 Mar 2016 16:09:33 +0100 (CET) Authentication-Results: open-mesh.org; dkim=fail reason="verification failed; unprotected key" header.d=narfation.org header.i=@narfation.org header.b=0/0CeOh+; dkim-adsp=fail (unprotected policy); dkim-atps=neutral Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=79.140.41.39; helo=v3-1039.vlinux.de; envelope-from=sven@narfation.org; receiver=b.a.t.m.a.n@lists.open-mesh.org Authentication-Results: open-mesh.org; dmarc=pass header.from=narfation.org Received: from v3-1039.vlinux.de (narfation.org [79.140.41.39]) by open-mesh.org (Postfix) with ESMTPS id 29C30823A2 for ; Sat, 5 Mar 2016 16:09:29 +0100 (CET) Received: from sven-desktop.home.narfation.org (p200300C593C286FD0000000000002E16.dip0.t-ipconnect.de [IPv6:2003:c5:93c2:86fd::2e16]) by v3-1039.vlinux.de (Postfix) with ESMTPSA id AB09411010E; Sat, 5 Mar 2016 16:09:28 +0100 (CET) Authentication-Results: v3-1039.vlinux.de; dmarc=none header.from=narfation.org DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=narfation.org; s=20121; t=1457190568; bh=iXPZwv4Q+2hI3gvIGqXlqw0nuXaXhH06jEzz0sJ/6oc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0/0CeOh+uFECQpxGvR1BBa22BRZw/zrMurHcP5Na1YYg65b4dIvog9GBDB8FOqb+z AEn3PSNDupBeAwt/hftFkjA1nzGGF77CMrbqZbvxG7rBSQqQZT/glFlijBuab2A0i0 oEpm+DrLqaAnHnsGPoRzwA/CBfH9WOmx42VWD/YA= From: Sven Eckelmann To: b.a.t.m.a.n@lists.open-mesh.org Date: Sat, 5 Mar 2016 16:09:17 +0100 Message-Id: <1457190564-11419-2-git-send-email-sven@narfation.org> X-Mailer: git-send-email 2.7.0 In-Reply-To: <1457190564-11419-1-git-send-email-sven@narfation.org> References: <1457190564-11419-1-git-send-email-sven@narfation.org> Subject: [B.A.T.M.A.N.] [PATCH 2/9] batman-adv: Check hard_iface refcnt when receiving skb X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking Errors-To: b.a.t.m.a.n-bounces@lists.open-mesh.org Sender: "B.A.T.M.A.N" The receive function may start processing an incoming packet while the hard_iface is shut down in a different context. All called functions called with the batadv_hard_iface object belonging to the incoming interface would have to check whether the reference counter is still > 0. This is rather error-prone because this check can be forgotten easily. Instead check the reference counter when receiving the object to make sure that all called functions have a valid reference. Signed-off-by: Sven Eckelmann --- net/batman-adv/main.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c index d64ddb9..bda5f13 100644 --- a/net/batman-adv/main.c +++ b/net/batman-adv/main.c @@ -401,11 +401,19 @@ int batadv_batman_skb_recv(struct sk_buff *skb, struct net_device *dev, hard_iface = container_of(ptype, struct batadv_hard_iface, batman_adv_ptype); + + /* don't receive packet for interface which gets shut down by batman-adv + * or otherwise it may gets tried to be referenced again in other + * structures like batadv_forw_packet + */ + if (!kref_get_unless_zero(&hard_iface->refcount)) + goto err_out; + skb = skb_share_check(skb, GFP_ATOMIC); /* skb was released by skb_share_check() */ if (!skb) - goto err_out; + goto err_put; /* packet should hold at least type and version */ if (unlikely(!pskb_may_pull(skb, 2))) @@ -448,6 +456,8 @@ int batadv_batman_skb_recv(struct sk_buff *skb, struct net_device *dev, if (ret == NET_RX_DROP) kfree_skb(skb); + batadv_hardif_put(hard_iface); + /* return NET_RX_SUCCESS in any case as we * most probably dropped the packet for * routing-logical reasons. @@ -456,6 +466,8 @@ int batadv_batman_skb_recv(struct sk_buff *skb, struct net_device *dev, err_free: kfree_skb(skb); +err_put: + batadv_hardif_put(hard_iface); err_out: return NET_RX_DROP; }