[B.A.T.M.A.N.] Staging: batman-adv for 2.6.37 (3)

[B.A.T.M.A.N.] Staging: batman-adv for 2.6.37 (3)

[Sven Eckelmann]

Hi,

here are patches targeted for 2.6.37. All patches needed for that patchset are
already part of your staging-next tree.

thanks,
	Sven

Marek Lindner (1):
      Staging: batman-adv: Introduce update_primary_addr to update mac address

Sven Eckelmann (11):
      Staging: batman-adv: checkpatch cleanup of comments
      Staging: batman-adv: Move mailing list address to .org
      Staging: batman-adv: Mark debugfs files as nonseekable
      Staging: batman-adv: wait for call_rcu before unloading module
      Staging: batman-adv: Introduce if_list_lock to protect if_list
      Staging: batman-adv: Always protect list_for_each_entry_rcu with RCU
      Staging: batman-adv: Remove unneeded rcu_read_lock
      Staging: batman-adv: Use synchronize_rcu instead of call_rcu
      Staging: batman-adv: Use refcnt to track usage count of batman_if
      Staging: batman-adv: count batman_if list queries as reference
      Staging: batman-adv: Track references of batman_if in set_primary_if

 drivers/staging/batman-adv/README           |    5 +-
 drivers/staging/batman-adv/TODO             |    7 +--
 drivers/staging/batman-adv/bat_debugfs.c    |    2 +
 drivers/staging/batman-adv/bat_sysfs.c      |   42 ++++++++++---
 drivers/staging/batman-adv/hard-interface.c |   89 +++++++++++++++++++-------
 drivers/staging/batman-adv/hard-interface.h |   13 ++++
 drivers/staging/batman-adv/icmp_socket.c    |    3 +
 drivers/staging/batman-adv/main.c           |    2 +-
 drivers/staging/batman-adv/originator.c     |    2 -
 drivers/staging/batman-adv/packet.h         |    2 +-
 drivers/staging/batman-adv/routing.c        |    2 +
 drivers/staging/batman-adv/types.h          |   21 +++---
 drivers/staging/batman-adv/vis.c            |   16 +++---
 13 files changed, 142 insertions(+), 64 deletions(-)

[B.A.T.M.A.N.] [PATCH 01/12] Staging: batman-adv: checkpatch cleanup of comments

[Sven Eckelmann]

checkpatch now detects the start of a comment and warns about usage of
multiple spaces at the beginning of a line. We have to replace the '   '
in multiple lines comments by ' * ' to fix it.

Checkpatch also wants a comment after a definition of a spinlock_t which
describes what it protects. It is currently not possible to add it
before the actual struct which includes the spinlock.

Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
---
 drivers/staging/batman-adv/packet.h |    2 +-
 drivers/staging/batman-adv/types.h  |   19 ++++++++++---------
 drivers/staging/batman-adv/vis.c    |   16 ++++++++--------
 3 files changed, 19 insertions(+), 18 deletions(-)

diff --git a/drivers/staging/batman-adv/packet.h b/drivers/staging/batman-adv/packet.h
index 44de1bf..2693383 100644
--- a/drivers/staging/batman-adv/packet.h
+++ b/drivers/staging/batman-adv/packet.h
@@ -79,7 +79,7 @@ struct icmp_packet {
 #define BAT_RR_LEN 16
 
 /* icmp_packet_rr must start with all fields from imcp_packet
-   as this is assumed by code that handles ICMP packets */
+ * as this is assumed by code that handles ICMP packets */
 struct icmp_packet_rr {
 	uint8_t  packet_type;
 	uint8_t  version;  /* batman version field */
diff --git a/drivers/staging/batman-adv/types.h b/drivers/staging/batman-adv/types.h
index 9d744d8..478277f 100644
--- a/drivers/staging/batman-adv/types.h
+++ b/drivers/staging/batman-adv/types.h
@@ -109,6 +109,7 @@ struct neigh_node {
 	struct batman_if *if_incoming;
 };
 
+
 struct bat_priv {
 	atomic_t mesh_state;
 	struct net_device_stats stats;
@@ -133,13 +134,13 @@ struct bat_priv {
 	struct hashtable_t *hna_local_hash;
 	struct hashtable_t *hna_global_hash;
 	struct hashtable_t *vis_hash;
-	spinlock_t orig_hash_lock;
-	spinlock_t forw_bat_list_lock;
-	spinlock_t forw_bcast_list_lock;
-	spinlock_t hna_lhash_lock;
-	spinlock_t hna_ghash_lock;
-	spinlock_t vis_hash_lock;
-	spinlock_t vis_list_lock;
+	spinlock_t orig_hash_lock; /* protects orig_hash */
+	spinlock_t forw_bat_list_lock; /* protects forw_bat_list */
+	spinlock_t forw_bcast_list_lock; /* protects  */
+	spinlock_t hna_lhash_lock; /* protects hna_local_hash */
+	spinlock_t hna_ghash_lock; /* protects hna_global_hash */
+	spinlock_t vis_hash_lock; /* protects vis_hash */
+	spinlock_t vis_list_lock; /* protects vis_info::recv_list */
 	int16_t num_local_hna;
 	atomic_t hna_local_changed;
 	struct delayed_work hna_work;
@@ -152,7 +153,7 @@ struct socket_client {
 	struct list_head queue_list;
 	unsigned int queue_len;
 	unsigned char index;
-	spinlock_t lock;
+	spinlock_t lock; /* protects queue_list, queue_len, index */
 	wait_queue_head_t queue_wait;
 	struct bat_priv *bat_priv;
 };
@@ -204,7 +205,7 @@ struct debug_log {
 	char log_buff[LOG_BUF_LEN];
 	unsigned long log_start;
 	unsigned long log_end;
-	spinlock_t lock;
+	spinlock_t lock; /* protects log_buff, log_start and log_end */
 	wait_queue_head_t queue_wait;
 };
 
diff --git a/drivers/staging/batman-adv/vis.c b/drivers/staging/batman-adv/vis.c
index b2cec8e..6b102a3 100644
--- a/drivers/staging/batman-adv/vis.c
+++ b/drivers/staging/batman-adv/vis.c
@@ -33,14 +33,14 @@
 #define smallest_signed_int(x) (1u << (7u + 8u * (sizeof(x) - 1u)))
 
 /* Checks if a sequence number x is a predecessor/successor of y.
-   they handle overflows/underflows and can correctly check for a
-   predecessor/successor unless the variable sequence number has grown by
-   more then 2**(bitwidth(x)-1)-1.
-   This means that for a uint8_t with the maximum value 255, it would think:
-    * when adding nothing - it is neither a predecessor nor a successor
-    * before adding more than 127 to the starting value - it is a predecessor,
-    * when adding 128 - it is neither a predecessor nor a successor,
-    * after adding more than 127 to the starting value - it is a successor */
+ * they handle overflows/underflows and can correctly check for a
+ * predecessor/successor unless the variable sequence number has grown by
+ * more then 2**(bitwidth(x)-1)-1.
+ * This means that for a uint8_t with the maximum value 255, it would think:
+ *  - when adding nothing - it is neither a predecessor nor a successor
+ *  - before adding more than 127 to the starting value - it is a predecessor,
+ *  - when adding 128 - it is neither a predecessor nor a successor,
+ *  - after adding more than 127 to the starting value - it is a successor */
 #define seq_before(x, y) ({typeof(x) _dummy = (x - y); \
 			_dummy > smallest_signed_int(_dummy); })
 #define seq_after(x, y) seq_before(y, x)
-- 
1.7.2.3

[B.A.T.M.A.N.] [PATCH 02/12] Staging: batman-adv: Move mailing list address to .org

[Sven Eckelmann]

The official mailing list is run on lists.open-mesh.org and it should be
avoided to sent them to lists.open-mesh.net to reduce the number of
receipents and double posts.

Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
---
 drivers/staging/batman-adv/README |    5 +++--
 drivers/staging/batman-adv/TODO   |    2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/batman-adv/README b/drivers/staging/batman-adv/README
index 3a975fc..7c878bb 100644
--- a/drivers/staging/batman-adv/README
+++ b/drivers/staging/batman-adv/README
@@ -229,8 +229,9 @@ CONTACT
 Please send us comments, experiences, questions, anything :)
 
 IRC:            #batman   on   irc.freenode.org
-Mailing-list:   b.a.t.m.a.n@open-mesh.net (optional  subscription
-          at https://lists.open-mesh.org/mm/listinfo/b.a.t.m.a.n)
+Mailing-list:   b.a.t.m.a.n@b.a.t.m.a.n@lists.open-mesh.org
+                (optional   subscription   at
+                 https://lists.open-mesh.org/mm/listinfo/b.a.t.m.a.n)
 
 You can also contact the Authors:
 
diff --git a/drivers/staging/batman-adv/TODO b/drivers/staging/batman-adv/TODO
index 3af8028..76b2acd 100644
--- a/drivers/staging/batman-adv/TODO
+++ b/drivers/staging/batman-adv/TODO
@@ -11,5 +11,5 @@ Please send all patches to:
 	Marek Lindner <lindner_marek@yahoo.de>
 	Simon Wunderlich <siwu@hrz.tu-chemnitz.de>
 	Andrew Lunn <andrew@lunn.ch>
-	b.a.t.m.a.n@lists.open-mesh.net
+	b.a.t.m.a.n@lists.open-mesh.org
 	Greg Kroah-Hartman <gregkh@suse.de>
-- 
1.7.2.3

[B.A.T.M.A.N.] [PATCH 03/12] Staging: batman-adv: Mark debugfs files as nonseekable

[Sven Eckelmann]

We don't allow to seek in the debugfs socket and log files. Thus we
should mark the file descriptor as nonseekable.

Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
Acked-by: Arnd Bergmann <arnd@arndb.de>
---
 drivers/staging/batman-adv/bat_debugfs.c |    2 ++
 drivers/staging/batman-adv/icmp_socket.c |    3 +++
 2 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/drivers/staging/batman-adv/bat_debugfs.c b/drivers/staging/batman-adv/bat_debugfs.c
index 507da68..57f84a9 100644
--- a/drivers/staging/batman-adv/bat_debugfs.c
+++ b/drivers/staging/batman-adv/bat_debugfs.c
@@ -90,6 +90,7 @@ int debug_log(struct bat_priv *bat_priv, char *fmt, ...)
 
 static int log_open(struct inode *inode, struct file *file)
 {
+	nonseekable_open(inode, file);
 	file->private_data = inode->i_private;
 	inc_module_count();
 	return 0;
@@ -174,6 +175,7 @@ static const struct file_operations log_fops = {
 	.release        = log_release,
 	.read           = log_read,
 	.poll           = log_poll,
+	.llseek         = no_llseek,
 };
 
 static int debug_log_setup(struct bat_priv *bat_priv)
diff --git a/drivers/staging/batman-adv/icmp_socket.c b/drivers/staging/batman-adv/icmp_socket.c
index 24627be..48856ca 100644
--- a/drivers/staging/batman-adv/icmp_socket.c
+++ b/drivers/staging/batman-adv/icmp_socket.c
@@ -45,6 +45,8 @@ static int bat_socket_open(struct inode *inode, struct file *file)
 	unsigned int i;
 	struct socket_client *socket_client;
 
+	nonseekable_open(inode, file);
+
 	socket_client = kmalloc(sizeof(struct socket_client), GFP_KERNEL);
 
 	if (!socket_client)
@@ -283,6 +285,7 @@ static const struct file_operations fops = {
 	.read = bat_socket_read,
 	.write = bat_socket_write,
 	.poll = bat_socket_poll,
+	.llseek = no_llseek,
 };
 
 int bat_socket_setup(struct bat_priv *bat_priv)
-- 
1.7.2.3

[B.A.T.M.A.N.] [PATCH 04/12] Staging: batman-adv: wait for call_rcu before unloading module

[Sven Eckelmann]

synchronize_rcu respective synchronize_net only waits for the rcu grace
period to elapse and we may fail to finish the calls which were made to
call_rcu in that time. In result the module could be unloaded during the
execution of the RCU callbacks.

rcu_barrier[1] will now wait for all outstanding RCU callbacks to finish
before continuing.

[1] Documentation/RCU/rcubarrier.txt

Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
---
 drivers/staging/batman-adv/main.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/staging/batman-adv/main.c b/drivers/staging/batman-adv/main.c
index 78ceebf..580ca02 100644
--- a/drivers/staging/batman-adv/main.c
+++ b/drivers/staging/batman-adv/main.c
@@ -72,7 +72,7 @@ static void __exit batman_exit(void)
 	destroy_workqueue(bat_event_workqueue);
 	bat_event_workqueue = NULL;
 
-	synchronize_net();
+	rcu_barrier();
 }
 
 int mesh_init(struct net_device *soft_iface)
-- 
1.7.2.3

[B.A.T.M.A.N.] [PATCH 05/12] Staging: batman-adv: Introduce if_list_lock to protect if_list

[Sven Eckelmann]

The update critical sections of if_list must be protected by a locking
primitive other than RCU. The iterator must also be protected by the
chosen locking mechanism.

The rtnl_lock in hardif_remove_interfaces must also be moved outside the
iterator primitive to ensure that we don't deadlock the kernel due to
differently nested locks in hardif_remove_interfaces and hard_if_event.

Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
---
 drivers/staging/batman-adv/hard-interface.c |   17 +++++++++++++++--
 1 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/batman-adv/hard-interface.c b/drivers/staging/batman-adv/hard-interface.c
index a587da9..35b198c 100644
--- a/drivers/staging/batman-adv/hard-interface.c
+++ b/drivers/staging/batman-adv/hard-interface.c
@@ -33,6 +33,9 @@
 
 #define MIN(x, y) ((x) < (y) ? (x) : (y))
 
+/* protect update critical side of if_list - but not the content */
+static DEFINE_SPINLOCK(if_list_lock);
+
 struct batman_if *get_batman_if_by_netdev(struct net_device *net_dev)
 {
 	struct batman_if *batman_if;
@@ -400,7 +403,11 @@ static struct batman_if *hardif_add_interface(struct net_device *net_dev)
 	INIT_LIST_HEAD(&batman_if->list);
 
 	check_known_mac_addr(batman_if->net_dev->dev_addr);
+
+	spin_lock(&if_list_lock);
 	list_add_tail_rcu(&batman_if->list, &if_list);
+	spin_unlock(&if_list_lock);
+
 	return batman_if;
 
 free_if:
@@ -428,6 +435,8 @@ static void hardif_remove_interface(struct batman_if *batman_if)
 		return;
 
 	batman_if->if_status = IF_TO_BE_REMOVED;
+
+	/* caller must take if_list_lock */
 	list_del_rcu(&batman_if->list);
 	sysfs_del_hardif(&batman_if->hardif_obj);
 	dev_put(batman_if->net_dev);
@@ -438,11 +447,13 @@ void hardif_remove_interfaces(void)
 {
 	struct batman_if *batman_if, *batman_if_tmp;
 
+	rtnl_lock();
+	spin_lock(&if_list_lock);
 	list_for_each_entry_safe(batman_if, batman_if_tmp, &if_list, list) {
-		rtnl_lock();
 		hardif_remove_interface(batman_if);
-		rtnl_unlock();
 	}
+	spin_unlock(&if_list_lock);
+	rtnl_unlock();
 }
 
 static int hard_if_event(struct notifier_block *this,
@@ -467,7 +478,9 @@ static int hard_if_event(struct notifier_block *this,
 		hardif_deactivate_interface(batman_if);
 		break;
 	case NETDEV_UNREGISTER:
+		spin_lock(&if_list_lock);
 		hardif_remove_interface(batman_if);
+		spin_unlock(&if_list_lock);
 		break;
 	case NETDEV_CHANGEMTU:
 		if (batman_if->soft_iface)
-- 
1.7.2.3

[B.A.T.M.A.N.] [PATCH 06/12] Staging: batman-adv: Always protect list_for_each_entry_rcu with RCU

[Sven Eckelmann]

receive_bat_packet is not called with rcu_read_lock so we must ensure by
ourself that we protect list_for_each_entry_rcu using the correct RCU
locks.

Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
---
 drivers/staging/batman-adv/routing.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/drivers/staging/batman-adv/routing.c b/drivers/staging/batman-adv/routing.c
index 2cf8cf9..58aa99e 100644
--- a/drivers/staging/batman-adv/routing.c
+++ b/drivers/staging/batman-adv/routing.c
@@ -563,6 +563,7 @@ void receive_bat_packet(struct ethhdr *ethhdr,
 		batman_packet->tq, batman_packet->ttl, batman_packet->version,
 		has_directlink_flag);
 
+	rcu_read_lock();
 	list_for_each_entry_rcu(batman_if, &if_list, list) {
 		if (batman_if->if_status != IF_ACTIVE)
 			continue;
@@ -585,6 +586,7 @@ void receive_bat_packet(struct ethhdr *ethhdr,
 		if (compare_orig(ethhdr->h_source, broadcast_addr))
 			is_broadcast = 1;
 	}
+	rcu_read_unlock();
 
 	if (batman_packet->version != COMPAT_VERSION) {
 		bat_dbg(DBG_BATMAN, bat_priv,
-- 
1.7.2.3

[B.A.T.M.A.N.] [PATCH 07/12] Staging: batman-adv: Remove unneeded rcu_read_lock

[Sven Eckelmann]

Regions which do not use rcu functions don't need to protected by
rcu_read_lock. If we want to protect data from being freed than it must
be covered by the same read-side critical section or otherwise the grace
period may already ended and freed the memory before we called
rcu_read_lock again.

Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
---
 drivers/staging/batman-adv/originator.c |    2 --
 1 files changed, 0 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/batman-adv/originator.c b/drivers/staging/batman-adv/originator.c
index f25d7fd..c530df1 100644
--- a/drivers/staging/batman-adv/originator.c
+++ b/drivers/staging/batman-adv/originator.c
@@ -329,7 +329,6 @@ int orig_seq_print_text(struct seq_file *seq, void *offset)
 				  net_dev->name);
 	}
 
-	rcu_read_lock();
 	seq_printf(seq, "[B.A.T.M.A.N. adv %s%s, MainIF/MAC: %s/%s (%s)]\n",
 		   SOURCE_VERSION, REVISION_VERSION_STR,
 		   bat_priv->primary_if->net_dev->name,
@@ -337,7 +336,6 @@ int orig_seq_print_text(struct seq_file *seq, void *offset)
 	seq_printf(seq, "  %-15s %s (%s/%i) %17s [%10s]: %20s ...\n",
 		   "Originator", "last-seen", "#", TQ_MAX_VALUE, "Nexthop",
 		   "outgoingIF", "Potential nexthops");
-	rcu_read_unlock();
 
 	spin_lock_irqsave(&bat_priv->orig_hash_lock, flags);
 
-- 
1.7.2.3

[B.A.T.M.A.N.] [PATCH 08/12] Staging: batman-adv: Use synchronize_rcu instead of call_rcu

[Sven Eckelmann]

It is recommended [1] to use synchronize_rcu to simplify the code -
especially when otherwise extra locking is needed to protect other code
from picking stale elements. It also protects us for emitting to many
callbacks which may results in OOM conditions.

The only reason not to use it, would be in performance critical sections
or when we are not allowed to block.

[1] Documentation/RCU/checklist.txt

Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
---
 drivers/staging/batman-adv/TODO             |    1 -
 drivers/staging/batman-adv/hard-interface.c |   10 ++--------
 drivers/staging/batman-adv/types.h          |    1 -
 3 files changed, 2 insertions(+), 10 deletions(-)

diff --git a/drivers/staging/batman-adv/TODO b/drivers/staging/batman-adv/TODO
index 76b2acd..cb6b026 100644
--- a/drivers/staging/batman-adv/TODO
+++ b/drivers/staging/batman-adv/TODO
@@ -1,7 +1,6 @@
  * Rework usage of RCU
     - don't leak pointers from rcu out of rcu critical area which may
       get freed
-    - check were synchronize_rcu must be used
     - go through Documentation/RCU/checklist.txt
  * Request a new review
  * Process the comments from the review
diff --git a/drivers/staging/batman-adv/hard-interface.c b/drivers/staging/batman-adv/hard-interface.c
index 35b198c..376ac48 100644
--- a/drivers/staging/batman-adv/hard-interface.c
+++ b/drivers/staging/batman-adv/hard-interface.c
@@ -418,13 +418,6 @@ out:
 	return NULL;
 }
 
-static void hardif_free_interface(struct rcu_head *rcu)
-{
-	struct batman_if *batman_if = container_of(rcu, struct batman_if, rcu);
-
-	kfree(batman_if);
-}
-
 static void hardif_remove_interface(struct batman_if *batman_if)
 {
 	/* first deactivate interface */
@@ -438,9 +431,10 @@ static void hardif_remove_interface(struct batman_if *batman_if)
 
 	/* caller must take if_list_lock */
 	list_del_rcu(&batman_if->list);
+	synchronize_rcu();
 	sysfs_del_hardif(&batman_if->hardif_obj);
 	dev_put(batman_if->net_dev);
-	call_rcu(&batman_if->rcu, hardif_free_interface);
+	kfree(batman_if);
 }
 
 void hardif_remove_interfaces(void)
diff --git a/drivers/staging/batman-adv/types.h b/drivers/staging/batman-adv/types.h
index 478277f..b162644 100644
--- a/drivers/staging/batman-adv/types.h
+++ b/drivers/staging/batman-adv/types.h
@@ -44,7 +44,6 @@ struct batman_if {
 	unsigned char *packet_buff;
 	int packet_len;
 	struct kobject *hardif_obj;
-	struct rcu_head rcu;
 	struct packet_type batman_adv_ptype;
 	struct net_device *soft_iface;
 };
-- 
1.7.2.3

[B.A.T.M.A.N.] [PATCH 09/12] Staging: batman-adv: Use refcnt to track usage count of batman_if

[Sven Eckelmann]

get_batman_if_by_netdev and get_active_batman_if may leak data from the
rcu protected list of interfaces. The rcu protected list of all gateway
nodes leaks the actual data outside the read-side critical area. This is
not valid as we may free the data using a call_rcu created callback
after we unlock using rcu_read_unlock. A workaround is to provide a
reference count to be sure that the memory isn't freed to early.

It is currently only to implement the already existing functionality and
doesn't provide the full tracking of all usage cases.

Additionally, we must hardif_hold inside the
rcu_read_lock()..rcu_read_unlock() before we attach to the structure
which "leaks" it. When another function now removed it from its usage
context (primary_if, usage on stack, ...) then we must hardif_put it. If
it is decremented to zero then we can issue the call_rcu to the freeing
function. So "put" is not allowed inside an rcu_read_lock.

Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
---
 drivers/staging/batman-adv/hard-interface.c |    5 +++--
 drivers/staging/batman-adv/hard-interface.h |   13 +++++++++++++
 drivers/staging/batman-adv/types.h          |    1 +
 3 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/batman-adv/hard-interface.c b/drivers/staging/batman-adv/hard-interface.c
index 376ac48..df6e5bd 100644
--- a/drivers/staging/batman-adv/hard-interface.c
+++ b/drivers/staging/batman-adv/hard-interface.c
@@ -401,6 +401,8 @@ static struct batman_if *hardif_add_interface(struct net_device *net_dev)
 	batman_if->soft_iface = NULL;
 	batman_if->if_status = IF_NOT_IN_USE;
 	INIT_LIST_HEAD(&batman_if->list);
+	atomic_set(&batman_if->refcnt, 0);
+	hardif_hold(batman_if);
 
 	check_known_mac_addr(batman_if->net_dev->dev_addr);
 
@@ -433,8 +435,7 @@ static void hardif_remove_interface(struct batman_if *batman_if)
 	list_del_rcu(&batman_if->list);
 	synchronize_rcu();
 	sysfs_del_hardif(&batman_if->hardif_obj);
-	dev_put(batman_if->net_dev);
-	kfree(batman_if);
+	hardif_put(batman_if);
 }
 
 void hardif_remove_interfaces(void)
diff --git a/drivers/staging/batman-adv/hard-interface.h b/drivers/staging/batman-adv/hard-interface.h
index 4b49527..d550889 100644
--- a/drivers/staging/batman-adv/hard-interface.h
+++ b/drivers/staging/batman-adv/hard-interface.h
@@ -42,4 +42,17 @@ int batman_skb_recv(struct sk_buff *skb,
 int hardif_min_mtu(struct net_device *soft_iface);
 void update_min_mtu(struct net_device *soft_iface);
 
+static inline void hardif_hold(struct batman_if *batman_if)
+{
+	atomic_inc(&batman_if->refcnt);
+}
+
+static inline void hardif_put(struct batman_if *batman_if)
+{
+	if (atomic_dec_and_test(&batman_if->refcnt)) {
+		dev_put(batman_if->net_dev);
+		kfree(batman_if);
+	}
+}
+
 #endif /* _NET_BATMAN_ADV_HARD_INTERFACE_H_ */
diff --git a/drivers/staging/batman-adv/types.h b/drivers/staging/batman-adv/types.h
index b162644..bb5827f 100644
--- a/drivers/staging/batman-adv/types.h
+++ b/drivers/staging/batman-adv/types.h
@@ -44,6 +44,7 @@ struct batman_if {
 	unsigned char *packet_buff;
 	int packet_len;
 	struct kobject *hardif_obj;
+	atomic_t refcnt;
 	struct packet_type batman_adv_ptype;
 	struct net_device *soft_iface;
 };
-- 
1.7.2.3

[B.A.T.M.A.N.] [PATCH 10/12] Staging: batman-adv: count batman_if list queries as reference

[Sven Eckelmann]

The return of get_batman_if_by_netdev and get_active_batman_if leaks a
pointer from the rcu protected list of interfaces. We must protect it to
prevent a too early release of the memory. Those functions must increase
the reference counter before rcu_read_unlock or it may be to late to
prevent a free.

hardif_add_interface must also increase the reference count for the
returned batman_if to make the behaviour consistent.

Reported-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
---
 drivers/staging/batman-adv/TODO             |    4 --
 drivers/staging/batman-adv/bat_sysfs.c      |   42 ++++++++++++++++++++------
 drivers/staging/batman-adv/hard-interface.c |   29 +++++++++++++++---
 3 files changed, 56 insertions(+), 19 deletions(-)

diff --git a/drivers/staging/batman-adv/TODO b/drivers/staging/batman-adv/TODO
index cb6b026..5913731 100644
--- a/drivers/staging/batman-adv/TODO
+++ b/drivers/staging/batman-adv/TODO
@@ -1,7 +1,3 @@
- * Rework usage of RCU
-    - don't leak pointers from rcu out of rcu critical area which may
-      get freed
-    - go through Documentation/RCU/checklist.txt
  * Request a new review
  * Process the comments from the review
  * Move into mainline proper
diff --git a/drivers/staging/batman-adv/bat_sysfs.c b/drivers/staging/batman-adv/bat_sysfs.c
index 0610169..bc17fb8 100644
--- a/drivers/staging/batman-adv/bat_sysfs.c
+++ b/drivers/staging/batman-adv/bat_sysfs.c
@@ -405,13 +405,17 @@ static ssize_t show_mesh_iface(struct kobject *kobj, struct attribute *attr,
 	struct device *dev = to_dev(kobj->parent);
 	struct net_device *net_dev = to_net_dev(dev);
 	struct batman_if *batman_if = get_batman_if_by_netdev(net_dev);
+	ssize_t length;
 
 	if (!batman_if)
 		return 0;
 
-	return sprintf(buff, "%s\n",
-		       batman_if->if_status == IF_NOT_IN_USE ?
-					"none" : batman_if->soft_iface->name);
+	length = sprintf(buff, "%s\n", batman_if->if_status == IF_NOT_IN_USE ?
+			 "none" : batman_if->soft_iface->name);
+
+	hardif_put(batman_if);
+
+	return length;
 }
 
 static ssize_t store_mesh_iface(struct kobject *kobj, struct attribute *attr,
@@ -421,6 +425,7 @@ static ssize_t store_mesh_iface(struct kobject *kobj, struct attribute *attr,
 	struct net_device *net_dev = to_net_dev(dev);
 	struct batman_if *batman_if = get_batman_if_by_netdev(net_dev);
 	int status_tmp = -1;
+	int ret;
 
 	if (!batman_if)
 		return count;
@@ -431,6 +436,7 @@ static ssize_t store_mesh_iface(struct kobject *kobj, struct attribute *attr,
 	if (strlen(buff) >= IFNAMSIZ) {
 		pr_err("Invalid parameter for 'mesh_iface' setting received: "
 		       "interface name too long '%s'\n", buff);
+		hardif_put(batman_if);
 		return -EINVAL;
 	}
 
@@ -440,13 +446,16 @@ static ssize_t store_mesh_iface(struct kobject *kobj, struct attribute *attr,
 		status_tmp = IF_I_WANT_YOU;
 
 	if ((batman_if->if_status == status_tmp) || ((batman_if->soft_iface) &&
-	    (strncmp(batman_if->soft_iface->name, buff, IFNAMSIZ) == 0)))
+	    (strncmp(batman_if->soft_iface->name, buff, IFNAMSIZ) == 0))) {
+		hardif_put(batman_if);
 		return count;
+	}
 
 	if (status_tmp == IF_NOT_IN_USE) {
 		rtnl_lock();
 		hardif_disable_interface(batman_if);
 		rtnl_unlock();
+		hardif_put(batman_if);
 		return count;
 	}
 
@@ -457,7 +466,10 @@ static ssize_t store_mesh_iface(struct kobject *kobj, struct attribute *attr,
 		rtnl_unlock();
 	}
 
-	return hardif_enable_interface(batman_if, buff);
+	ret = hardif_enable_interface(batman_if, buff);
+	hardif_put(batman_if);
+
+	return ret;
 }
 
 static ssize_t show_iface_status(struct kobject *kobj, struct attribute *attr,
@@ -466,23 +478,33 @@ static ssize_t show_iface_status(struct kobject *kobj, struct attribute *attr,
 	struct device *dev = to_dev(kobj->parent);
 	struct net_device *net_dev = to_net_dev(dev);
 	struct batman_if *batman_if = get_batman_if_by_netdev(net_dev);
+	ssize_t length;
 
 	if (!batman_if)
 		return 0;
 
 	switch (batman_if->if_status) {
 	case IF_TO_BE_REMOVED:
-		return sprintf(buff, "disabling\n");
+		length = sprintf(buff, "disabling\n");
+		break;
 	case IF_INACTIVE:
-		return sprintf(buff, "inactive\n");
+		length = sprintf(buff, "inactive\n");
+		break;
 	case IF_ACTIVE:
-		return sprintf(buff, "active\n");
+		length = sprintf(buff, "active\n");
+		break;
 	case IF_TO_BE_ACTIVATED:
-		return sprintf(buff, "enabling\n");
+		length = sprintf(buff, "enabling\n");
+		break;
 	case IF_NOT_IN_USE:
 	default:
-		return sprintf(buff, "not in use\n");
+		length = sprintf(buff, "not in use\n");
+		break;
 	}
+
+	hardif_put(batman_if);
+
+	return length;
 }
 
 static BAT_ATTR(mesh_iface, S_IRUGO | S_IWUSR,
diff --git a/drivers/staging/batman-adv/hard-interface.c b/drivers/staging/batman-adv/hard-interface.c
index df6e5bd..eef5631 100644
--- a/drivers/staging/batman-adv/hard-interface.c
+++ b/drivers/staging/batman-adv/hard-interface.c
@@ -49,6 +49,9 @@ struct batman_if *get_batman_if_by_netdev(struct net_device *net_dev)
 	batman_if = NULL;
 
 out:
+	if (batman_if)
+		hardif_hold(batman_if);
+
 	rcu_read_unlock();
 	return batman_if;
 }
@@ -96,6 +99,9 @@ static struct batman_if *get_active_batman_if(struct net_device *soft_iface)
 	batman_if = NULL;
 
 out:
+	if (batman_if)
+		hardif_hold(batman_if);
+
 	rcu_read_unlock();
 	return batman_if;
 }
@@ -292,6 +298,7 @@ int hardif_enable_interface(struct batman_if *batman_if, char *iface_name)
 	batman_if->batman_adv_ptype.type = __constant_htons(ETH_P_BATMAN);
 	batman_if->batman_adv_ptype.func = batman_skb_recv;
 	batman_if->batman_adv_ptype.dev = batman_if->net_dev;
+	hardif_hold(batman_if);
 	dev_add_pack(&batman_if->batman_adv_ptype);
 
 	atomic_set(&batman_if->seqno, 1);
@@ -350,13 +357,20 @@ void hardif_disable_interface(struct batman_if *batman_if)
 	bat_info(batman_if->soft_iface, "Removing interface: %s\n",
 		 batman_if->net_dev->name);
 	dev_remove_pack(&batman_if->batman_adv_ptype);
+	hardif_put(batman_if);
 
 	bat_priv->num_ifaces--;
 	orig_hash_del_if(batman_if, bat_priv->num_ifaces);
 
-	if (batman_if == bat_priv->primary_if)
-		set_primary_if(bat_priv,
-			       get_active_batman_if(batman_if->soft_iface));
+	if (batman_if == bat_priv->primary_if) {
+		struct batman_if *new_if;
+
+		new_if = get_active_batman_if(batman_if->soft_iface);
+		set_primary_if(bat_priv, new_if);
+
+		if (new_if)
+			hardif_put(new_if);
+	}
 
 	kfree(batman_if->packet_buff);
 	batman_if->packet_buff = NULL;
@@ -410,6 +424,8 @@ static struct batman_if *hardif_add_interface(struct net_device *net_dev)
 	list_add_tail_rcu(&batman_if->list, &if_list);
 	spin_unlock(&if_list_lock);
 
+	/* extra reference for return */
+	hardif_hold(batman_if);
 	return batman_if;
 
 free_if:
@@ -459,7 +475,7 @@ static int hard_if_event(struct notifier_block *this,
 	struct bat_priv *bat_priv;
 
 	if (!batman_if && event == NETDEV_REGISTER)
-			batman_if = hardif_add_interface(net_dev);
+		batman_if = hardif_add_interface(net_dev);
 
 	if (!batman_if)
 		goto out;
@@ -482,8 +498,10 @@ static int hard_if_event(struct notifier_block *this,
 			update_min_mtu(batman_if->soft_iface);
 		break;
 	case NETDEV_CHANGEADDR:
-		if (batman_if->if_status == IF_NOT_IN_USE)
+		if (batman_if->if_status == IF_NOT_IN_USE) {
+			hardif_put(batman_if);
 			goto out;
+		}
 
 		check_known_mac_addr(batman_if->net_dev->dev_addr);
 		update_mac_addresses(batman_if);
@@ -495,6 +513,7 @@ static int hard_if_event(struct notifier_block *this,
 	default:
 		break;
 	};
+	hardif_put(batman_if);
 
 out:
 	return NOTIFY_DONE;
-- 
1.7.2.3

[B.A.T.M.A.N.] [PATCH 11/12] Staging: batman-adv: Track references of batman_if in set_primary_if

[Sven Eckelmann]

set_primary_if exchanges the current primary interfaces with a new one.
This is a new reference and thus we have to count it and decrease the
count of the old primary interface.

Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
---
 drivers/staging/batman-adv/hard-interface.c |    8 ++++++++
 1 files changed, 8 insertions(+), 0 deletions(-)

diff --git a/drivers/staging/batman-adv/hard-interface.c b/drivers/staging/batman-adv/hard-interface.c
index eef5631..a9d6f1d 100644
--- a/drivers/staging/batman-adv/hard-interface.c
+++ b/drivers/staging/batman-adv/hard-interface.c
@@ -111,9 +111,17 @@ static void set_primary_if(struct bat_priv *bat_priv,
 {
 	struct batman_packet *batman_packet;
 	struct vis_packet *vis_packet;
+	struct batman_if *old_if;
 
+	if (batman_if)
+		hardif_hold(batman_if);
+
+	old_if = bat_priv->primary_if;
 	bat_priv->primary_if = batman_if;
 
+	if (old_if)
+		hardif_put(old_if);
+
 	if (!bat_priv->primary_if)
 		return;
 
-- 
1.7.2.3

[B.A.T.M.A.N.] [PATCH 12/12] Staging: batman-adv: Introduce update_primary_addr to update mac address

[Sven Eckelmann]

From: Marek Lindner <lindner_marek@yahoo.de>

set_primary_if is currently misused to update the mac address in vis
packets. This unneeded and introduces overhead due to other operations
which must be done when updating the primary interface.

Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
---
 drivers/staging/batman-adv/hard-interface.c |   22 ++++++++++++++--------
 1 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/drivers/staging/batman-adv/hard-interface.c b/drivers/staging/batman-adv/hard-interface.c
index a9d6f1d..7b77cf2 100644
--- a/drivers/staging/batman-adv/hard-interface.c
+++ b/drivers/staging/batman-adv/hard-interface.c
@@ -106,11 +106,22 @@ out:
 	return batman_if;
 }
 
+static void update_primary_addr(struct bat_priv *bat_priv)
+{
+	struct vis_packet *vis_packet;
+
+	vis_packet = (struct vis_packet *)
+				bat_priv->my_vis_info->skb_packet->data;
+	memcpy(vis_packet->vis_orig,
+	       bat_priv->primary_if->net_dev->dev_addr, ETH_ALEN);
+	memcpy(vis_packet->sender_orig,
+	       bat_priv->primary_if->net_dev->dev_addr, ETH_ALEN);
+}
+
 static void set_primary_if(struct bat_priv *bat_priv,
 			   struct batman_if *batman_if)
 {
 	struct batman_packet *batman_packet;
-	struct vis_packet *vis_packet;
 	struct batman_if *old_if;
 
 	if (batman_if)
@@ -129,12 +140,7 @@ static void set_primary_if(struct bat_priv *bat_priv,
 	batman_packet->flags = PRIMARIES_FIRST_HOP;
 	batman_packet->ttl = TTL;
 
-	vis_packet = (struct vis_packet *)
-				bat_priv->my_vis_info->skb_packet->data;
-	memcpy(vis_packet->vis_orig,
-	       bat_priv->primary_if->net_dev->dev_addr, ETH_ALEN);
-	memcpy(vis_packet->sender_orig,
-	       bat_priv->primary_if->net_dev->dev_addr, ETH_ALEN);
+	update_primary_addr(bat_priv);
 
 	/***
 	 * hacky trick to make sure that we send the HNA information via
@@ -516,7 +522,7 @@ static int hard_if_event(struct notifier_block *this,
 
 		bat_priv = netdev_priv(batman_if->soft_iface);
 		if (batman_if == bat_priv->primary_if)
-			set_primary_if(bat_priv, batman_if);
+			update_primary_addr(bat_priv);
 		break;
 	default:
 		break;
-- 
1.7.2.3