[maint] batman-adv: Fix double neigh_node_put in batadv_v_ogm_route_update

  The router is put down twice when it was non-NULL and either orig_ifinfo is
NULL afterwards or batman-adv receives a packet with the same sequence
number. This will end up in a use-after-free when the batadv_neigh_node is
removed because the reference counter ended up too early at 0.

Fixes: 667996ebeab4 ("batman-adv: OGMv2 - implement originators logic")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
It looks like this bug was solved in next/master by refactoring in
30c96bc7870f ("batman-adv: move and restructure batadv_v_ogm_forward")

only compile tested. Please add so many reported by as you want - 
just don't know it it is *the* bug and who actually reported it.
---
 net/batman-adv/bat_v_ogm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
  

On Fri, May 06, 2016 at 10:27:09PM +0200, Sven Eckelmann wrote:
> The router is put down twice when it was non-NULL and either orig_ifinfo is
> NULL afterwards or batman-adv receives a packet with the same sequence
> number. This will end up in a use-after-free when the batadv_neigh_node is
> removed because the reference counter ended up too early at 0.
> 
> Fixes: 667996ebeab4 ("batman-adv: OGMv2 - implement originators logic")
> Signed-off-by: Sven Eckelmann <sven@narfation.org>

Tested-by: Antonio Quartulli <a@unstable.cc>

it fixes the crash reported in "Kernel panic by BATMAN_V @WBMv9" for me.

@Marek: can you also test this patch in your environment to see if you still see
the crash?

Cheers,
  

On Friday, May 06, 2016 22:27:09 Sven Eckelmann wrote:
> The router is put down twice when it was non-NULL and either orig_ifinfo is
> NULL afterwards or batman-adv receives a packet with the same sequence
> number. This will end up in a use-after-free when the batadv_neigh_node is
> removed because the reference counter ended up too early at 0.
> 
> Fixes: 667996ebeab4 ("batman-adv: OGMv2 - implement originators logic")
> Signed-off-by: Sven Eckelmann <sven@narfation.org>
> ---
> It looks like this bug was solved in next/master by refactoring in
> 30c96bc7870f ("batman-adv: move and restructure batadv_v_ogm_forward")
> 
> only compile tested. Please add so many reported by as you want - 
> just don't know it it is *the* bug and who actually reported it.
> ---
>  net/batman-adv/bat_v_ogm.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

Applied in revision fc3e79d.

Thanks,
Marek
  

Hello,

I just got openwrt 15.05.1 with batman-adv 2016.1 on 3 picostation HP, 
this time a selected before the build of openwrt batman V option, I can 
see it when it ask for available routing algo ,

root@OpenWrt:/etc/init.d# cat /sys/kernel/debug/batman_adv/routing_algos
Available routing algorithms:
  * BATMAN_IV
  * BATMAN_V

but when I do :

echo BATMAN_V > /sys/module/batman_adv/parameters/routing_algo

It does nothing, still on BATMAN_IV during session and on reboot ?

Best Regards,

Laurent
  

On Saturday 07 May 2016 14:29:17 contact wrote:
> I just got openwrt 15.05.1 with batman-adv 2016.1 on 3 picostation HP,
> this time a selected before the build of openwrt batman V option, I can
> see it when it ask for available routing algo ,
> 
> root@OpenWrt:/etc/init.d# cat /sys/kernel/debug/batman_adv/routing_algos
> Available routing algorithms:
>   * BATMAN_IV
>   * BATMAN_V
> 
> but when I do :
> 
> echo BATMAN_V > /sys/module/batman_adv/parameters/routing_algo
> 
> It does nothing, still on BATMAN_IV during session and on reboot ?

Please don't hijack other (unrelated) threads,

Kind regards,
	Sven