From patchwork Sun Mar 20 11:27:53 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sven Eckelmann X-Patchwork-Id: 15940 X-Patchwork-Delegate: mareklindner@neomailbox.ch Return-Path: X-Original-To: patchwork@open-mesh.org Delivered-To: patchwork@open-mesh.org Received: from open-mesh.org (localhost [127.0.0.1]) by open-mesh.org (Postfix) with ESMTP id 6575A82337; Sun, 20 Mar 2016 12:27:58 +0100 (CET) Authentication-Results: open-mesh.org; dkim=fail reason="verification failed; unprotected key" header.d=narfation.org header.i=@narfation.org header.b=xsl0dwgt; dkim-adsp=fail (unprotected policy); dkim-atps=neutral Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=79.140.41.39; helo=v3-1039.vlinux.de; envelope-from=sven@narfation.org; receiver=b.a.t.m.a.n@lists.open-mesh.org Authentication-Results: open-mesh.org; dmarc=pass header.from=narfation.org Received: from v3-1039.vlinux.de (narfation.org [79.140.41.39]) by open-mesh.org (Postfix) with ESMTPS id 18E70819B7 for ; Sun, 20 Mar 2016 12:27:56 +0100 (CET) Received: from sven-desktop.home.narfation.org (p200300C593C4B1FD0000000000002E16.dip0.t-ipconnect.de [IPv6:2003:c5:93c4:b1fd::2e16]) by v3-1039.vlinux.de (Postfix) with ESMTPSA id 789A61100A5; Sun, 20 Mar 2016 12:27:56 +0100 (CET) Authentication-Results: v3-1039.vlinux.de; dmarc=none header.from=narfation.org DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=narfation.org; s=20121; t=1458473276; bh=Yr/vK/C8kQaQHBIy5vZEsFI28FVNSkWCtXgHiRUpUeg=; h=From:To:Cc:Subject:Date:From; b=xsl0dwgtfPpR8nHNAERmhwAlR8pg7Egl87azTph6Ywvb4Ai6MlSBtRc2hbXA3J9kI rD/vndjwm5n+KfsxcoUzRMzFnG4qNSPE2KbToyE0xhnCVDbMJ9I57xK0hnhHoxqTrF 5Gn6wLcL/PY6lC/edwTOzjf/C1In6xaELZbfZomA= From: Sven Eckelmann To: b.a.t.m.a.n@lists.open-mesh.org Date: Sun, 20 Mar 2016 12:27:53 +0100 Message-Id: <1458473273-8769-1-git-send-email-sven@narfation.org> X-Mailer: git-send-email 2.8.0.rc3 Subject: [B.A.T.M.A.N.] [PATCH maint v2] batman-adv: Reduce refcnt of removed router when updating route X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking Errors-To: b.a.t.m.a.n-bounces@lists.open-mesh.org Sender: "B.A.T.M.A.N" _batadv_update_route rcu_derefences orig_ifinfo->router outside of a spinlock protected region to print some information messages to the debug log. But this pointer is not checked again when the new pointer is assigned in the spinlock protected region. Thus is can happen that the value of orig_ifinfo->router changed in the meantime and thus the reference counter of the wrong router gets reduced after the spinlock protected region. Just rcu_dereferencing the value of orig_ifinfo->router inside the spinlock protected region (which also set the new pointer) is enough to get the correct old router object. Fixes: d90ddb94423f ("batman-adv: Make orig_node->router an rcu protected pointer") Signed-off-by: Sven Eckelmann --- v2: - add comment explaining the idea behind the extra rcu_dereference_protected --- net/batman-adv/routing.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c index 1fb1be3..18fc4db 100644 --- a/net/batman-adv/routing.c +++ b/net/batman-adv/routing.c @@ -104,6 +104,13 @@ static void _batadv_update_route(struct batadv_priv *bat_priv, neigh_node = NULL; spin_lock_bh(&orig_node->neigh_list_lock); + /* get previous best router to decrease the reference counter later. + * curr_router used earlier may not be the current orig_ifinfo->router + * because it was dereferenced outside of the neigh_list_lock protected + * region. + */ + curr_router = rcu_dereference_protected(orig_ifinfo->router, true); + rcu_assign_pointer(orig_ifinfo->router, neigh_node); spin_unlock_bh(&orig_node->neigh_list_lock); batadv_orig_ifinfo_free_ref(orig_ifinfo);