lkml.org 
[lkml]   [2016]   [May]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 39/67] batman-adv: Reduce refcnt of removed router when updating route
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Sven Eckelmann <sven@narfation.org>

    commit d1a65f1741bfd9c69f9e4e2ad447a89b6810427d upstream.

    _batadv_update_route rcu_derefences orig_ifinfo->router outside of a
    spinlock protected region to print some information messages to the debug
    log. But this pointer is not checked again when the new pointer is assigned
    in the spinlock protected region. Thus is can happen that the value of
    orig_ifinfo->router changed in the meantime and thus the reference counter
    of the wrong router gets reduced after the spinlock protected region.

    Just rcu_dereferencing the value of orig_ifinfo->router inside the spinlock
    protected region (which also set the new pointer) is enough to get the
    correct old router object.

    Fixes: e1a5382f978b ("batman-adv: Make orig_node->router an rcu protected pointer")
    Signed-off-by: Sven Eckelmann <sven@narfation.org>
    Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
    Signed-off-by: Antonio Quartulli <a@unstable.cc>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/batman-adv/routing.c | 9 +++++++++
    1 file changed, 9 insertions(+)

    --- a/net/batman-adv/routing.c
    +++ b/net/batman-adv/routing.c
    @@ -104,6 +104,15 @@ static void _batadv_update_route(struct
    neigh_node = NULL;

    spin_lock_bh(&orig_node->neigh_list_lock);
    + /* curr_router used earlier may not be the current orig_ifinfo->router
    + * anymore because it was dereferenced outside of the neigh_list_lock
    + * protected region. After the new best neighbor has replace the current
    + * best neighbor the reference counter needs to decrease. Consequently,
    + * the code needs to ensure the curr_router variable contains a pointer
    + * to the replaced best neighbor.
    + */
    + curr_router = rcu_dereference_protected(orig_ifinfo->router, true);
    +
    rcu_assign_pointer(orig_ifinfo->router, neigh_node);
    spin_unlock_bh(&orig_node->neigh_list_lock);
    batadv_orig_ifinfo_free_ref(orig_ifinfo);

    \
     
     \ /
      Last update: 2016-05-09 09:41    [W:4.086 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site