From patchwork Tue Sep 6 07:25:28 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Simon Wunderlich X-Patchwork-Id: 16680 Return-Path: X-Original-To: patchwork@open-mesh.org Delivered-To: patchwork@open-mesh.org Received: from open-mesh.org (localhost [IPv6:::1]) by open-mesh.org (Postfix) with ESMTP id C9C4382EF4; Tue, 6 Sep 2016 09:25:47 +0200 (CEST) Authentication-Results: open-mesh.org; dmarc=none header.from=simonwunderlich.de Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=79.140.42.25; helo=mail.mail.packetmixer.de; envelope-from=sw@simonwunderlich.de; receiver=b.a.t.m.a.n@lists.open-mesh.org Authentication-Results: open-mesh.org; dmarc=none header.from=simonwunderlich.de Received: from mail.mail.packetmixer.de (packetmixer.de [79.140.42.25]) by open-mesh.org (Postfix) with ESMTPS id A1EAD80F0C for ; Tue, 6 Sep 2016 09:25:38 +0200 (CEST) Received: from kero.packetmixer.de (p2003007C6F783000527B9DFFFECE2EDC.dip0.t-ipconnect.de [IPv6:2003:7c:6f78:3000:527b:9dff:fece:2edc]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.mail.packetmixer.de (Postfix) with ESMTPSA id 86CF81F000A; Tue, 6 Sep 2016 09:25:38 +0200 (CEST) From: Simon Wunderlich To: stable@vger.kernel.org Date: Tue, 6 Sep 2016 09:25:28 +0200 Message-Id: <20160906072529.5587-2-sw@simonwunderlich.de> X-Mailer: git-send-email 2.9.3 In-Reply-To: <20160906072529.5587-1-sw@simonwunderlich.de> References: <20160906072529.5587-1-sw@simonwunderlich.de> MIME-Version: 1.0 Cc: b.a.t.m.a.n@lists.open-mesh.org, Marek Lindner Subject: [B.A.T.M.A.N.] [PATCH 4.6] batman-adv: Fix pagefault during neigh_node free X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking Errors-To: b.a.t.m.a.n-bounces@lists.open-mesh.org Sender: "B.A.T.M.A.N" From: Marek Lindner commit d9f179877e50ae2681fe7b0b83e0d9f63b6165ad upstream. The access of the neigh_node->orig_node is not allowed anymore when the batadv_neigh_node is freed. But this function is still trying to do it go get an routing algorithm specific function pointer via the neigh_node->orig_node. This function is then used to free the routing algorithm specific neighbor node data. This sometimes causes a crash when the orig_node was already freed when the this function tries to read from its old memory region. The code can just be removed since no routing algorithm implements the function pointer. Reported-by: Lars Bußmann Signed-off-by: Marek Lindner [sven@narfation.org: rewritten commit message to make clear that it is an bugfix to an user reported crash] Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich --- net/batman-adv/originator.c | 5 ----- net/batman-adv/types.h | 3 --- 2 files changed, 8 deletions(-) diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c index c355a82..0039e25 100644 --- a/net/batman-adv/originator.c +++ b/net/batman-adv/originator.c @@ -251,10 +251,8 @@ static void batadv_neigh_node_release(struct kref *ref) struct hlist_node *node_tmp; struct batadv_neigh_node *neigh_node; struct batadv_neigh_ifinfo *neigh_ifinfo; - struct batadv_algo_ops *bao; neigh_node = container_of(ref, struct batadv_neigh_node, refcount); - bao = neigh_node->orig_node->bat_priv->bat_algo_ops; hlist_for_each_entry_safe(neigh_ifinfo, node_tmp, &neigh_node->ifinfo_list, list) { @@ -263,9 +261,6 @@ static void batadv_neigh_node_release(struct kref *ref) batadv_hardif_neigh_put(neigh_node->hardif_neigh); - if (bao->bat_neigh_free) - bao->bat_neigh_free(neigh_node); - batadv_hardif_put(neigh_node->if_incoming); kfree_rcu(neigh_node, rcu); diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h index 1e47fbe..b0e7d36 100644 --- a/net/batman-adv/types.h +++ b/net/batman-adv/types.h @@ -1270,8 +1270,6 @@ struct batadv_forw_packet { * better than neigh2 for their respective outgoing interface from the metric * prospective * @bat_neigh_print: print the single hop neighbor list (optional) - * @bat_neigh_free: free the resources allocated by the routing algorithm for a - * neigh_node object * @bat_orig_print: print the originator table (optional) * @bat_orig_free: free the resources allocated by the routing algorithm for an * orig_node object @@ -1302,7 +1300,6 @@ struct batadv_algo_ops { struct batadv_neigh_node *neigh2, struct batadv_hard_iface *if_outgoing2); void (*bat_neigh_print)(struct batadv_priv *priv, struct seq_file *seq); - void (*bat_neigh_free)(struct batadv_neigh_node *neigh); /* orig_node handling API */ void (*bat_orig_print)(struct batadv_priv *priv, struct seq_file *seq, struct batadv_hard_iface *hard_iface);