b.a.t.m.a.n.lists.open-mesh.org archive mirror
 help / color / mirror / Atom feed
* [B.A.T.M.A.N.] [PATCH 01/23] batman-adv: Fix list removal of batadv_hardif_neigh_node
@ 2015-12-15 23:31 Sven Eckelmann
  2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 02/23] batman-adv: Convert batadv_hardif_neigh_node to kref Sven Eckelmann
                   ` (22 more replies)
  0 siblings, 23 replies; 24+ messages in thread
From: Sven Eckelmann @ 2015-12-15 23:31 UTC (permalink / raw)
  To: b.a.t.m.a.n

The neigh_list with batadv_hardif_neigh_node objects is accessed with only
rcu_read_lock in batadv_neigh_node_get and batadv_iv_neigh_print. Thus is
is not allowed to kfree the object before the rcu grace period ends which
may still tries to access this object. Therefore the object has first to be
removed from the neigh_list and then it has either wait with
synchronize_rcu or call_rcu till the grace period ends before it can be
freed.

Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
I have no idea why batadv_hardif_neigh_free_now is considered to be safe to
call. The only caller is batadv_neigh_node_free_rcu but this function never
makes sure that the previously mentioned two functions are actually not
accessing it right now when hlist_del_rcu_init + kfree is called.
---
 net/batman-adv/originator.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 00b0437..2681c7d 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -217,10 +217,6 @@ static void batadv_hardif_neigh_free_rcu(struct rcu_head *rcu)
 
 	hardif_neigh = container_of(rcu, struct batadv_hardif_neigh_node, rcu);
 
-	spin_lock_bh(&hardif_neigh->if_incoming->neigh_list_lock);
-	hlist_del_init_rcu(&hardif_neigh->list);
-	spin_unlock_bh(&hardif_neigh->if_incoming->neigh_list_lock);
-
 	batadv_hardif_free_ref_now(hardif_neigh->if_incoming);
 	kfree(hardif_neigh);
 }
@@ -233,8 +229,13 @@ static void batadv_hardif_neigh_free_rcu(struct rcu_head *rcu)
 static void
 batadv_hardif_neigh_free_now(struct batadv_hardif_neigh_node *hardif_neigh)
 {
-	if (atomic_dec_and_test(&hardif_neigh->refcount))
+	if (atomic_dec_and_test(&hardif_neigh->refcount)) {
+		spin_lock_bh(&hardif_neigh->if_incoming->neigh_list_lock);
+		hlist_del_init_rcu(&hardif_neigh->list);
+		spin_unlock_bh(&hardif_neigh->if_incoming->neigh_list_lock);
+
 		batadv_hardif_neigh_free_rcu(&hardif_neigh->rcu);
+	}
 }
 
 /**
@@ -244,8 +245,13 @@ batadv_hardif_neigh_free_now(struct batadv_hardif_neigh_node *hardif_neigh)
  */
 void batadv_hardif_neigh_free_ref(struct batadv_hardif_neigh_node *hardif_neigh)
 {
-	if (atomic_dec_and_test(&hardif_neigh->refcount))
+	if (atomic_dec_and_test(&hardif_neigh->refcount)) {
+		spin_lock_bh(&hardif_neigh->if_incoming->neigh_list_lock);
+		hlist_del_init_rcu(&hardif_neigh->list);
+		spin_unlock_bh(&hardif_neigh->if_incoming->neigh_list_lock);
+
 		call_rcu(&hardif_neigh->rcu, batadv_hardif_neigh_free_rcu);
+	}
 }
 
 /**
-- 
2.6.4


^ permalink raw reply related	[flat|nested] 24+ messages in thread

end of thread, other threads:[~2015-12-19 22:34 UTC | newest]

Thread overview: 24+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-12-15 23:31 [B.A.T.M.A.N.] [PATCH 01/23] batman-adv: Fix list removal of batadv_hardif_neigh_node Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 02/23] batman-adv: Convert batadv_hardif_neigh_node to kref Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 03/23] batman-adv: Avoid recursive call_rcu for batadv_hardif_neigh_node Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 04/23] batman-adv: Drop immediate free functions " Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 05/23] batman-adv: Drop batadv_hardif_neigh_free_rcu Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 06/23] batman-adv: Convert batadv_gw_node to kref Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 07/23] batman-adv: Convert batadv_softif_vlan " Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 08/23] batman-adv: Convert batadv_bla_backbone_gw " Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 09/23] batman-adv: Convert batadv_bla_claim " Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 10/23] batman-adv: Convert batadv_nc_node " Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 11/23] batman-adv: Convert batadv_nc_path " Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 12/23] batman-adv: Convert batadv_dat_entry " Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 13/23] batman-adv: Convert batadv_tvlv_container " Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 14/23] batman-adv: Convert batadv_tvlv_handler " Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 15/23] batman-adv: Convert batadv_orig_node_free_rcu " Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 16/23] batman-adv: Convert batadv_neigh_ifinfo " Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 17/23] batman-adv: Convert batadv_orig_ifinfo " Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 18/23] batman-adv: Convert batadv_neigh_node " Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 19/23] batman-adv: Convert batadv_hard_iface " Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 20/23] batman-adv: Convert batadv_orig_node_vlan " Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 21/23] batman-adv: Convert batadv_orig_node " Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 22/23] batman-adv: Convert batadv_tt_common_entry " Sven Eckelmann
2015-12-15 23:31 ` [B.A.T.M.A.N.] [PATCH 23/23] batman-adv: Add lockdep assert for container_list_lock Sven Eckelmann
2015-12-19 22:34 ` [B.A.T.M.A.N.] [PATCH 01/23] batman-adv: Fix list removal of batadv_hardif_neigh_node Sven Eckelmann

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).