Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c2e703a5 authored by Johannes Berg's avatar Johannes Berg
Browse files

mac80211: mesh: fix call_rcu() usage 



When using call_rcu(), the called function may be delayed quite
significantly, and without a matching rcu_barrier() there's no
way to be sure it has finished.
Therefore, global state that could be gone/freed/reused should
never be touched in the callback.

Fix this in mesh by moving the atomic_dec() into the caller;
that's not really a problem since we already unlinked the path
and it will be destroyed anyway.

This fixes a crash Jouni observed when running certain tests in
a certain order, in which the mesh interface was torn down, the
memory reused for a function pointer (work struct) and running
that then crashed since the pointer had been decremented by 1,
resulting in an invalid instruction byte stream.

Cc: stable@vger.kernel.org
Fixes: eb2b9311 ("mac80211: mesh path table implementation")
Reported-by: default avatarJouni Malinen <j@w1.fi>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 45bb780a

net/mac80211/mesh_pathtbl.c

+4 −4
Original line number Original line Diff line number Diff line
@@ -779,10 +779,8 @@ void mesh_plink_broken(struct sta_info *sta) 
static void mesh_path_node_reclaim(struct rcu_head *rp)

static void mesh_path_node_reclaim(struct rcu_head *rp)

{

{

	struct mpath_node *node = container_of(rp, struct mpath_node, rcu);

	struct mpath_node *node = container_of(rp, struct mpath_node, rcu);

	struct ieee80211_sub_if_data *sdata = node->mpath->sdata;





	del_timer_sync(&node->mpath->timer);

	del_timer_sync(&node->mpath->timer);

	atomic_dec(&sdata->u.mesh.mpaths);

	kfree(node->mpath);

	kfree(node->mpath);

	kfree(node);

	kfree(node);

}

}
@@ -790,8 +788,9 @@ static void mesh_path_node_reclaim(struct rcu_head *rp) 
/* needs to be called with the corresponding hashwlock taken */

/* needs to be called with the corresponding hashwlock taken */

static void __mesh_path_del(struct mesh_table *tbl, struct mpath_node *node)

static void __mesh_path_del(struct mesh_table *tbl, struct mpath_node *node)

{

{

	struct mesh_path *mpath;

	struct mesh_path *mpath = node->mpath;

	mpath = node->mpath;

	struct ieee80211_sub_if_data *sdata = node->mpath->sdata;



	spin_lock(&mpath->state_lock);

	spin_lock(&mpath->state_lock);

	mpath->flags |= MESH_PATH_RESOLVING;

	mpath->flags |= MESH_PATH_RESOLVING;

	if (mpath->is_gate)

	if (mpath->is_gate)
@@ -799,6 +798,7 @@ static void __mesh_path_del(struct mesh_table *tbl, struct mpath_node *node) 
	hlist_del_rcu(&node->list);

	hlist_del_rcu(&node->list);

	call_rcu(&node->rcu, mesh_path_node_reclaim);

	call_rcu(&node->rcu, mesh_path_node_reclaim);

	spin_unlock(&mpath->state_lock);

	spin_unlock(&mpath->state_lock);

	atomic_dec(&sdata->u.mesh.mpaths);

	atomic_dec(&tbl->entries);

	atomic_dec(&tbl->entries);

}

}