Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 93652344 authored by Sven Eckelmann's avatar Sven Eckelmann Committed by Simon Wunderlich
Browse files

batman-adv: Add missing refcnt for last_candidate 



batadv_find_router dereferences last_bonding_candidate from
orig_node without making sure that it has a valid reference. This reference
has to be retrieved by increasing the reference counter while holding
neigh_list_lock. The lock is required to avoid that
batadv_last_bonding_replace removes the current last_bonding_candidate,
reduces the reference counter and maybe destroys the object in this
process.

Fixes: f3b3d901 ("batman-adv: add bonding again")
Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
Signed-off-by: default avatarMarek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: default avatarSimon Wunderlich <sw@simonwunderlich.de>
parent 1fe323aa

net/batman-adv/routing.c

+27 −1
Original line number Diff line number Diff line
@@ -469,6 +469,29 @@ static int batadv_check_unicast_packet(struct batadv_priv *bat_priv, 
	return 0;

}



/**

 * batadv_last_bonding_get - Get last_bonding_candidate of orig_node

 * @orig_node: originator node whose last bonding candidate should be retrieved

 *

 * Return: last bonding candidate of router or NULL if not found

 *

 * The object is returned with refcounter increased by 1.

 */

static struct batadv_orig_ifinfo *

batadv_last_bonding_get(struct batadv_orig_node *orig_node)

{

	struct batadv_orig_ifinfo *last_bonding_candidate;



	spin_lock_bh(&orig_node->neigh_list_lock);

	last_bonding_candidate = orig_node->last_bonding_candidate;



	if (last_bonding_candidate)

		kref_get(&last_bonding_candidate->refcount);

	spin_unlock_bh(&orig_node->neigh_list_lock);



	return last_bonding_candidate;

}



/**

 * batadv_last_bonding_replace - Replace last_bonding_candidate of orig_node

 * @orig_node: originator node whose bonding candidates should be replaced
@@ -539,7 +562,7 @@ batadv_find_router(struct batadv_priv *bat_priv, 
	 * router - obviously there are no other candidates.

	 */

	rcu_read_lock();

	last_candidate = orig_node->last_bonding_candidate;

	last_candidate = batadv_last_bonding_get(orig_node);

	if (last_candidate)

		last_cand_router = rcu_dereference(last_candidate->router);
@@ -631,6 +654,9 @@ batadv_find_router(struct batadv_priv *bat_priv, 
		batadv_orig_ifinfo_put(next_candidate);

	}



	if (last_candidate)

		batadv_orig_ifinfo_put(last_candidate);



	return router;

}