Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1421231

[PATCH 3.16 045/114] batman-adv: Reduce refcnt of removed router when updating route

Show all headers | View raw

3.16.36-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <sven@narfation.org>

commit d1a65f1741bfd9c69f9e4e2ad447a89b6810427d upstream.

_batadv_update_route rcu_derefences orig_ifinfo->router outside of a
spinlock protected region to print some information messages to the debug
log. But this pointer is not checked again when the new pointer is assigned
in the spinlock protected region. Thus is can happen that the value of
orig_ifinfo->router changed in the meantime and thus the reference counter
of the wrong router gets reduced after the spinlock protected region.

Just rcu_dereferencing the value of orig_ifinfo->router inside the spinlock
protected region (which also set the new pointer) is enough to get the
correct old router object.

Fixes: e1a5382f978b ("batman-adv: Make orig_node->router an rcu protected pointer")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Antonio Quartulli <a@unstable.cc>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 net/batman-adv/routing.c | 9 +++++++++
 1 file changed, 9 insertions(+)

--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -88,6 +88,15 @@ static void _batadv_update_route(struct
 		neigh_node = NULL;
 
 	spin_lock_bh(&orig_node->neigh_list_lock);
+	/* curr_router used earlier may not be the current orig_ifinfo->router
+	 * anymore because it was dereferenced outside of the neigh_list_lock
+	 * protected region. After the new best neighbor has replace the current
+	 * best neighbor the reference counter needs to decrease. Consequently,
+	 * the code needs to ensure the curr_router variable contains a pointer
+	 * to the replaced best neighbor.
+	 */
+	curr_router = rcu_dereference_protected(orig_ifinfo->router, true);
+
 	rcu_assign_pointer(orig_ifinfo->router, neigh_node);
 	spin_unlock_bh(&orig_node->neigh_list_lock);
 	batadv_orig_ifinfo_free_ref(orig_ifinfo);

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.16 000/114] 3.16.36-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2016-06-13 21:20 +0200
  [PATCH 3.16 014/114] kvm: x86: do not leak guest xcr0 into host  interrupt handlers Ben Hutchings <ben@decadent.org.uk> - 2016-06-13 21:20 +0200
  [PATCH 3.16 045/114] batman-adv: Reduce refcnt of removed router  when updating route Ben Hutchings <ben@decadent.org.uk> - 2016-06-13 21:20 +0200
  [PATCH 3.16 040/114] s390/hugetlb: add hugepages_supported define Ben Hutchings <ben@decadent.org.uk> - 2016-06-13 21:20 +0200
  [PATCH 3.16 013/114] assoc_array: don't call compare_object() on  a node Ben Hutchings <ben@decadent.org.uk> - 2016-06-13 21:20 +0200
  [PATCH 3.16 027/114] crypto: ccp - Prevent information leakage on  export Ben Hutchings <ben@decadent.org.uk> - 2016-06-13 21:20 +0200
  [PATCH 3.16 069/114] tracing: Don't display trigger file for  events that can't be enabled Ben Hutchings <ben@decadent.org.uk> - 2016-06-13 21:20 +0200
  [PATCH 3.16 012/114] drm/i915: Exit cherryview_irq_handler()  after one pass Ben Hutchings <ben@decadent.org.uk> - 2016-06-13 21:20 +0200
    Re: [PATCH 3.16 012/114] drm/i915: Exit cherryview_irq_handler()  after one pass Ville Syrjälä <ville.syrjala@linux.intel.com> - 2016-06-14 12:50 +0200
      Re: [PATCH 3.16 012/114] drm/i915: Exit cherryview_irq_handler()  after one pass Ben Hutchings <ben@decadent.org.uk> - 2016-06-14 13:40 +0200
        Re: [PATCH 3.16 012/114] drm/i915: Exit cherryview_irq_handler()  after one pass Ville Syrjälä <ville.syrjala@linux.intel.com> - 2016-06-14 14:10 +0200
          Re: [PATCH 3.16 012/114] drm/i915: Exit cherryview_irq_handler()  after one pass Ben Hutchings <ben@decadent.org.uk> - 2016-06-14 14:50 +0200
            Re: [PATCH 3.16 012/114] drm/i915: Exit cherryview_irq_handler()  after one pass Ville Syrjälä <ville.syrjala@linux.intel.com> - 2016-06-14 15:10 +0200
  [PATCH 3.16 009/114] Input: gtco - fix crash on detecting device  without endpoints Ben Hutchings <ben@decadent.org.uk> - 2016-06-13 21:20 +0200
  [PATCH 3.16 058/114] mm/huge_memory: replace VM_NO_THP VM_BUG_ON  with actual VMA check Ben Hutchings <ben@decadent.org.uk> - 2016-06-13 21:20 +0200
  Re: [PATCH 3.16 000/114] 3.16.36-rc1 review Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2016-06-13 23:20 +0200
  Re: [PATCH 3.16 000/114] 3.16.36-rc1 review Guenter Roeck <linux@roeck-us.net> - 2016-06-14 04:00 +0200
    Re: [PATCH 3.16 000/114] 3.16.36-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2016-06-14 13:30 +0200

csiph-web