diff options
| author | Sven Eckelmann <sven@narfation.org> | 2020-03-18 00:27:10 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-03-20 09:06:28 +0100 |
| commit | 1428d490247cbe82d3d84dff8fea225f2199b4b1 (patch) | |
| tree | 3e3f482e2bc223681a25493571889e4eea7d609d /net/batman-adv | |
| parent | bfab05e446bcc679fe5791d11c4e5474d9f2f8dc (diff) | |
batman-adv: Add missing refcnt for last_candidate
commit 936523441bb64cdc9a5b263e8fd2782e70313a57 upstream.
batadv_find_router dereferences last_bonding_candidate from
orig_node without making sure that it has a valid reference. This reference
has to be retrieved by increasing the reference counter while holding
neigh_list_lock. The lock is required to avoid that
batadv_last_bonding_replace removes the current last_bonding_candidate,
reduces the reference counter and maybe destroys the object in this
process.
Fixes: f3b3d9018975 ("batman-adv: add bonding again")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/batman-adv')
| -rw-r--r-- | net/batman-adv/routing.c | 28 |
1 files changed, 27 insertions, 1 deletions
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c index ff9aefddb6ef..39b4c6ab3e71 100644 --- a/net/batman-adv/routing.c +++ b/net/batman-adv/routing.c @@ -440,6 +440,29 @@ static int batadv_check_unicast_packet(struct batadv_priv *bat_priv, } /** + * batadv_last_bonding_get - Get last_bonding_candidate of orig_node + * @orig_node: originator node whose last bonding candidate should be retrieved + * + * Return: last bonding candidate of router or NULL if not found + * + * The object is returned with refcounter increased by 1. + */ +static struct batadv_orig_ifinfo * +batadv_last_bonding_get(struct batadv_orig_node *orig_node) +{ + struct batadv_orig_ifinfo *last_bonding_candidate; + + spin_lock_bh(&orig_node->neigh_list_lock); + last_bonding_candidate = orig_node->last_bonding_candidate; + + if (last_bonding_candidate) + atomic_inc(&last_bonding_candidate->refcount); + spin_unlock_bh(&orig_node->neigh_list_lock); + + return last_bonding_candidate; +} + +/** * batadv_last_bonding_replace - Replace last_bonding_candidate of orig_node * @orig_node: originator node whose bonding candidates should be replaced * @new_candidate: new bonding candidate or NULL @@ -509,7 +532,7 @@ batadv_find_router(struct batadv_priv *bat_priv, * router - obviously there are no other candidates. */ rcu_read_lock(); - last_candidate = orig_node->last_bonding_candidate; + last_candidate = batadv_last_bonding_get(orig_node); if (last_candidate) last_cand_router = rcu_dereference(last_candidate->router); @@ -601,6 +624,9 @@ next: batadv_orig_ifinfo_free_ref(next_candidate); } + if (last_candidate) + batadv_orig_ifinfo_free_ref(last_candidate); + return router; } |