lkml.org 
[lkml]   [2016]   [Oct]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.7 048/141] batman-adv: Add missing refcnt for last_candidate
    Date
    4.7-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Sven Eckelmann <sven@narfation.org>

    commit 936523441bb64cdc9a5b263e8fd2782e70313a57 upstream.

    batadv_find_router dereferences last_bonding_candidate from
    orig_node without making sure that it has a valid reference. This reference
    has to be retrieved by increasing the reference counter while holding
    neigh_list_lock. The lock is required to avoid that
    batadv_last_bonding_replace removes the current last_bonding_candidate,
    reduces the reference counter and maybe destroys the object in this
    process.

    Fixes: f3b3d9018975 ("batman-adv: add bonding again")
    Signed-off-by: Sven Eckelmann <sven@narfation.org>
    Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
    Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/batman-adv/routing.c | 28 +++++++++++++++++++++++++++-
    1 file changed, 27 insertions(+), 1 deletion(-)

    --- a/net/batman-adv/routing.c
    +++ b/net/batman-adv/routing.c
    @@ -456,6 +456,29 @@ static int batadv_check_unicast_packet(s
    }

    /**
    + * batadv_last_bonding_get - Get last_bonding_candidate of orig_node
    + * @orig_node: originator node whose last bonding candidate should be retrieved
    + *
    + * Return: last bonding candidate of router or NULL if not found
    + *
    + * The object is returned with refcounter increased by 1.
    + */
    +static struct batadv_orig_ifinfo *
    +batadv_last_bonding_get(struct batadv_orig_node *orig_node)
    +{
    + struct batadv_orig_ifinfo *last_bonding_candidate;
    +
    + spin_lock_bh(&orig_node->neigh_list_lock);
    + last_bonding_candidate = orig_node->last_bonding_candidate;
    +
    + if (last_bonding_candidate)
    + kref_get(&last_bonding_candidate->refcount);
    + spin_unlock_bh(&orig_node->neigh_list_lock);
    +
    + return last_bonding_candidate;
    +}
    +
    +/**
    * batadv_last_bonding_replace - Replace last_bonding_candidate of orig_node
    * @orig_node: originator node whose bonding candidates should be replaced
    * @new_candidate: new bonding candidate or NULL
    @@ -525,7 +548,7 @@ batadv_find_router(struct batadv_priv *b
    * router - obviously there are no other candidates.
    */
    rcu_read_lock();
    - last_candidate = orig_node->last_bonding_candidate;
    + last_candidate = batadv_last_bonding_get(orig_node);
    if (last_candidate)
    last_cand_router = rcu_dereference(last_candidate->router);

    @@ -617,6 +640,9 @@ next:
    batadv_orig_ifinfo_put(next_candidate);
    }

    + if (last_candidate)
    + batadv_orig_ifinfo_put(last_candidate);
    +
    return router;
    }


    \
     
     \ /
      Last update: 2016-10-06 11:47    [W:4.352 / U:0.556 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site