From: Sven Eckelmann <sven@narfation.org>
To: b.a.t.m.a.n@lists.open-mesh.org
Subject: [B.A.T.M.A.N.] [PATCH 2/9] batman-adv: Check hard_iface refcnt when receiving skb
Date: Sat, 5 Mar 2016 16:09:17 +0100 [thread overview]
Message-ID: <1457190564-11419-2-git-send-email-sven@narfation.org> (raw)
In-Reply-To: <1457190564-11419-1-git-send-email-sven@narfation.org>
The receive function may start processing an incoming packet while the
hard_iface is shut down in a different context. All called functions called
with the batadv_hard_iface object belonging to the incoming interface would
have to check whether the reference counter is still > 0.
This is rather error-prone because this check can be forgotten easily.
Instead check the reference counter when receiving the object to make sure
that all called functions have a valid reference.
Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
net/batman-adv/main.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index d64ddb9..bda5f13 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -401,11 +401,19 @@ int batadv_batman_skb_recv(struct sk_buff *skb, struct net_device *dev,
hard_iface = container_of(ptype, struct batadv_hard_iface,
batman_adv_ptype);
+
+ /* don't receive packet for interface which gets shut down by batman-adv
+ * or otherwise it may gets tried to be referenced again in other
+ * structures like batadv_forw_packet
+ */
+ if (!kref_get_unless_zero(&hard_iface->refcount))
+ goto err_out;
+
skb = skb_share_check(skb, GFP_ATOMIC);
/* skb was released by skb_share_check() */
if (!skb)
- goto err_out;
+ goto err_put;
/* packet should hold at least type and version */
if (unlikely(!pskb_may_pull(skb, 2)))
@@ -448,6 +456,8 @@ int batadv_batman_skb_recv(struct sk_buff *skb, struct net_device *dev,
if (ret == NET_RX_DROP)
kfree_skb(skb);
+ batadv_hardif_put(hard_iface);
+
/* return NET_RX_SUCCESS in any case as we
* most probably dropped the packet for
* routing-logical reasons.
@@ -456,6 +466,8 @@ int batadv_batman_skb_recv(struct sk_buff *skb, struct net_device *dev,
err_free:
kfree_skb(skb);
+err_put:
+ batadv_hardif_put(hard_iface);
err_out:
return NET_RX_DROP;
}
--
2.7.0
next prev parent reply other threads:[~2016-03-05 15:09 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-03-05 15:09 [B.A.T.M.A.N.] [PATCH 1/9] batman-adv: Check hard_iface refcnt before calling function Sven Eckelmann
2016-03-05 15:09 ` Sven Eckelmann [this message]
2016-03-28 14:27 ` [B.A.T.M.A.N.] [PATCH 2/9] batman-adv: Check hard_iface refcnt when receiving skb Marek Lindner
2016-03-05 15:09 ` [B.A.T.M.A.N.] [PATCH 3/9] batman-adv: Increase hard_iface refcnt for ptype Sven Eckelmann
2016-03-31 8:58 ` Marek Lindner
2016-03-05 15:09 ` [B.A.T.M.A.N.] [PATCH 4/9] batman-adv: Use kref_get for hard_iface subfunctions Sven Eckelmann
2016-04-11 10:13 ` Marek Lindner
2016-04-11 10:55 ` Sven Eckelmann
2016-03-05 15:09 ` [B.A.T.M.A.N.] [PATCH 5/9] batman-adv: Use kref_get for batadv_tvlv_container_get Sven Eckelmann
2016-04-11 10:18 ` Marek Lindner
2016-03-05 15:09 ` [B.A.T.M.A.N.] [PATCH 6/9] batman-adv: Use kref_get for batadv_nc_get_nc_node Sven Eckelmann
2016-04-11 10:24 ` Marek Lindner
2016-03-05 15:09 ` [B.A.T.M.A.N.] [PATCH 7/9] batman-adv: Use kref_get for batadv_gw_select Sven Eckelmann
2016-04-11 10:25 ` Marek Lindner
2016-03-05 15:09 ` [B.A.T.M.A.N.] [PATCH 8/9] batman-adv: Use kref_get for batadv_gw_node_add Sven Eckelmann
2016-04-11 10:29 ` Marek Lindner
2016-03-05 15:09 ` [B.A.T.M.A.N.] [PATCH 9/9] batman-adv: Use kref_get for _batadv_update_route Sven Eckelmann
2016-03-05 18:05 ` [B.A.T.M.A.N.] [PATCH v2 " Sven Eckelmann
2016-04-11 10:36 ` Marek Lindner
2016-03-06 0:08 ` [B.A.T.M.A.N.] [PATCH 1/9] batman-adv: Check hard_iface refcnt before calling function Andrew Lunn
2016-03-06 8:55 ` Sven Eckelmann
2016-03-06 14:10 ` Andrew Lunn
2016-03-28 14:19 ` Marek Lindner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1457190564-11419-2-git-send-email-sven@narfation.org \
--to=sven@narfation.org \
--cc=b.a.t.m.a.n@lists.open-mesh.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).