Commit f0b94ebc authored by Sven Eckelmann's avatar Sven Eckelmann Committed by Antonio Quartulli
Browse files

batman-adv: Use kref_get for _batadv_update_route 



_batadv_update_route requires that the caller already has a valid reference
for neigh_node. It is therefore not possible that it has an reference
counter of 0 and was still given to this function

The kref_get function instead WARNs (with debug information) when the
reference counter would still be 0. This makes a bug in batman-adv better
visible because kref_get_unless_zero would have ignored this problem.

Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
Signed-off-by: default avatarMarek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: default avatarAntonio Quartulli <a@unstable.cc>
parent 17a86915

net/batman-adv/routing.c

+4 −4
Original line number Original line Diff line number Diff line
@@ -100,10 +100,6 @@ static void _batadv_update_route(struct batadv_priv *bat_priv, 
	if (curr_router)

	if (curr_router)

		batadv_neigh_node_put(curr_router);

		batadv_neigh_node_put(curr_router);





	/* increase refcount of new best neighbor */

	if (neigh_node && !kref_get_unless_zero(&neigh_node->refcount))

		neigh_node = NULL;



	spin_lock_bh(&orig_node->neigh_list_lock);

	spin_lock_bh(&orig_node->neigh_list_lock);

	/* curr_router used earlier may not be the current orig_ifinfo->router

	/* curr_router used earlier may not be the current orig_ifinfo->router

	 * anymore because it was dereferenced outside of the neigh_list_lock

	 * anymore because it was dereferenced outside of the neigh_list_lock
@@ -114,6 +110,10 @@ static void _batadv_update_route(struct batadv_priv *bat_priv, 
	 */

	 */

	curr_router = rcu_dereference_protected(orig_ifinfo->router, true);

	curr_router = rcu_dereference_protected(orig_ifinfo->router, true);





	/* increase refcount of new best neighbor */

	if (neigh_node)

		kref_get(&neigh_node->refcount);



	rcu_assign_pointer(orig_ifinfo->router, neigh_node);

	rcu_assign_pointer(orig_ifinfo->router, neigh_node);

	spin_unlock_bh(&orig_node->neigh_list_lock);

	spin_unlock_bh(&orig_node->neigh_list_lock);

	batadv_orig_ifinfo_put(orig_ifinfo);

	batadv_orig_ifinfo_put(orig_ifinfo);

CRA Git | Maintained and supported by SUSTech CRA and CCSE