From patchwork Sun Aug 12 19:04:44 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sven Eckelmann X-Patchwork-Id: 17459 X-Patchwork-Delegate: sw@simonwunderlich.de Return-Path: X-Original-To: patchwork@open-mesh.org Delivered-To: patchwork@open-mesh.org Received: from open-mesh.org (localhost [IPv6:::1]) by open-mesh.org (Postfix) with ESMTP id D58FA82DAA; Sun, 12 Aug 2018 21:05:01 +0200 (CEST) Authentication-Results: open-mesh.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=narfation.org header.i=@narfation.org header.b="Axw+vnTC"; dkim-atps=neutral Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=2001:4d88:2000:7::2; helo=v3-1039.vlinux.de; envelope-from=sven@narfation.org; receiver= Received: from v3-1039.vlinux.de (narfation.org [IPv6:2001:4d88:2000:7::2]) by open-mesh.org (Postfix) with ESMTPS id 9636C82D42 for ; Sun, 12 Aug 2018 21:04:59 +0200 (CEST) Received: from sven-desktop.home.narfation.org (p200300C593C7FBFD0000000000008096.dip0.t-ipconnect.de [IPv6:2003:c5:93c7:fbfd::8096]) by v3-1039.vlinux.de (Postfix) with ESMTPSA id 17F4C110135; Sun, 12 Aug 2018 21:04:59 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=narfation.org; s=20121; t=1534100699; bh=oCjUd7qvCuT61Bf16xEJOAeaakhvZ1eRRRH45TMSm0M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Axw+vnTCR11AK6A1iAdG4Xwv2XRYCOpYlY0ANtb9q0mNk38mgcpiLA8uIu7LYEujE 7jRkHHMIHwnqpDYAoeNqIMHiZljH17/lXhkrVLZJ+K5ltJkBrwyIv3WZGVS40BeBVw qJLBSAXua5Qh3i2Ud8CL5UnJTdCKqGSoXGJIn09s= From: Sven Eckelmann To: b.a.t.m.a.n@lists.open-mesh.org Date: Sun, 12 Aug 2018 21:04:44 +0200 Message-Id: <20180812190445.28013-5-sven@narfation.org> X-Mailer: git-send-email 2.18.0 In-Reply-To: <20180812190445.28013-1-sven@narfation.org> References: <20180812190445.28013-1-sven@narfation.org> Subject: [B.A.T.M.A.N.] [PATCH 4/5] batman-adv: Prevent duplicated global TT entry X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking Errors-To: b.a.t.m.a.n-bounces@lists.open-mesh.org Sender: "B.A.T.M.A.N" The function batadv_tt_global_orig_entry_add is responsible for adding new tt_orig_list_entry to the orig_list. It first checks whether the entry already is in the list or not. If it is, then the creation of a new entry is aborted. But the lock for the list is only held when the list is really modified. This could lead to duplicated entries because another context could create an entry with the same key between the check and the list manipulation. The check and the manipulation of the list must therefore be in the same locked code section. Fixes: c5eb5bb30321 ("batman-adv: add reference counting for type batadv_tt_orig_list_entry") Signed-off-by: Sven Eckelmann Acked-by: Marek Lindner --- net/batman-adv/translation-table.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index 12a2b7d2..d21624c4 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -1613,6 +1613,8 @@ batadv_tt_global_orig_entry_add(struct batadv_tt_global_entry *tt_global, { struct batadv_tt_orig_list_entry *orig_entry; + spin_lock_bh(&tt_global->list_lock); + orig_entry = batadv_tt_global_orig_entry_find(tt_global, orig_node); if (orig_entry) { /* refresh the ttvn: the current value could be a bogus one that @@ -1635,11 +1637,9 @@ batadv_tt_global_orig_entry_add(struct batadv_tt_global_entry *tt_global, orig_entry->flags = flags; kref_init(&orig_entry->refcount); - spin_lock_bh(&tt_global->list_lock); kref_get(&orig_entry->refcount); hlist_add_head_rcu(&orig_entry->list, &tt_global->orig_list); - spin_unlock_bh(&tt_global->list_lock); atomic_inc(&tt_global->orig_list_count); sync_flags: @@ -1647,6 +1647,8 @@ batadv_tt_global_orig_entry_add(struct batadv_tt_global_entry *tt_global, out: if (orig_entry) batadv_tt_orig_list_entry_put(orig_entry); + + spin_unlock_bh(&tt_global->list_lock); } /**