Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e1a5382f authored by Linus Lüssing's avatar Linus Lüssing Committed by Sven Eckelmann
Browse files

batman-adv: Make orig_node->router an rcu protected pointer 



The rcu protected macros rcu_dereference() and rcu_assign_pointer()
for the orig_node->router need to be used, as well as spin/rcu locking.
Otherwise we might end up using a router pointer pointing to already
freed memory.

Therefore this commit introduces the safe getter method
orig_node_get_router().

Signed-off-by: default avatarLinus Lüssing <linus.luessing@web.de>
Signed-off-by: default avatarMarek Lindner <lindner_marek@yahoo.de>
Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
parent 57f0c07c

net/batman-adv/gateway_client.c

+48 −32
Original line number Diff line number Diff line
@@ -98,6 +98,7 @@ void gw_election(struct bat_priv *bat_priv) 
{

	struct hlist_node *node;

	struct gw_node *gw_node, *curr_gw, *curr_gw_tmp = NULL;

	struct neigh_node *router;

	uint8_t max_tq = 0;

	uint32_t max_gw_factor = 0, tmp_gw_factor = 0;

	int down, up;
@@ -133,10 +134,11 @@ void gw_election(struct bat_priv *bat_priv) 
	}



	hlist_for_each_entry_rcu(gw_node, node, &bat_priv->gw_list, list) {

		if (!gw_node->orig_node->router)

		if (gw_node->deleted)

			continue;



		if (gw_node->deleted)

		router = orig_node_get_router(gw_node->orig_node);

		if (!router)

			continue;



		switch (atomic_read(&bat_priv->gw_sel_class)) {
@@ -144,15 +146,14 @@ void gw_election(struct bat_priv *bat_priv) 
			gw_bandwidth_to_kbit(gw_node->orig_node->gw_flags,

					     &down, &up);



			tmp_gw_factor = (gw_node->orig_node->router->tq_avg *

					 gw_node->orig_node->router->tq_avg *

			tmp_gw_factor = (router->tq_avg * router->tq_avg *

					 down * 100 * 100) /

					 (TQ_LOCAL_WINDOW_SIZE *

					 TQ_LOCAL_WINDOW_SIZE * 64);



			if ((tmp_gw_factor > max_gw_factor) ||

			    ((tmp_gw_factor == max_gw_factor) &&

			     (gw_node->orig_node->router->tq_avg > max_tq)))

			     (router->tq_avg > max_tq)))

				curr_gw_tmp = gw_node;

			break;
@@ -164,19 +165,25 @@ void gw_election(struct bat_priv *bat_priv) 
			  *     soon as a better gateway appears which has

			  *     $routing_class more tq points)

			  **/

			if (gw_node->orig_node->router->tq_avg > max_tq)

			if (router->tq_avg > max_tq)

				curr_gw_tmp = gw_node;

			break;

		}



		if (gw_node->orig_node->router->tq_avg > max_tq)

			max_tq = gw_node->orig_node->router->tq_avg;

		if (router->tq_avg > max_tq)

			max_tq = router->tq_avg;



		if (tmp_gw_factor > max_gw_factor)

			max_gw_factor = tmp_gw_factor;



		neigh_node_free_ref(router);

	}



	if (curr_gw != curr_gw_tmp) {

		router = orig_node_get_router(curr_gw_tmp->orig_node);

		if (!router)

			goto out;



		if ((curr_gw) && (!curr_gw_tmp))

			bat_dbg(DBG_BATMAN, bat_priv,

				"Removing selected gateway - "
@@ -187,45 +194,47 @@ void gw_election(struct bat_priv *bat_priv) 
				"(gw_flags: %i, tq: %i)\n",

				curr_gw_tmp->orig_node->orig,

				curr_gw_tmp->orig_node->gw_flags,

				curr_gw_tmp->orig_node->router->tq_avg);

				router->tq_avg);

		else

			bat_dbg(DBG_BATMAN, bat_priv,

				"Changing route to gateway %pM "

				"(gw_flags: %i, tq: %i)\n",

				curr_gw_tmp->orig_node->orig,

				curr_gw_tmp->orig_node->gw_flags,

				curr_gw_tmp->orig_node->router->tq_avg);

				router->tq_avg);



		neigh_node_free_ref(router);

		gw_select(bat_priv, curr_gw_tmp);

	}



out:

	rcu_read_unlock();

}



void gw_check_election(struct bat_priv *bat_priv, struct orig_node *orig_node)

{

	struct orig_node *curr_gw_orig;

	struct neigh_node *router_gw = NULL, *router_orig = NULL;

	uint8_t gw_tq_avg, orig_tq_avg;



	curr_gw_orig = gw_get_selected(bat_priv);

	if (!curr_gw_orig)

		goto deselect;



	rcu_read_lock();

	if (!curr_gw_orig->router)

		goto deselect_rcu;

	router_gw = orig_node_get_router(curr_gw_orig);

	if (!router_gw)

		goto deselect;



	/* this node already is the gateway */

	if (curr_gw_orig == orig_node)

		goto out_rcu;



	if (!orig_node->router)

		goto out_rcu;

		goto out;



	gw_tq_avg = curr_gw_orig->router->tq_avg;

	rcu_read_unlock();

	router_orig = orig_node_get_router(orig_node);

	if (!router_orig)

		goto out;



	orig_tq_avg = orig_node->router->tq_avg;

	gw_tq_avg = router_gw->tq_avg;

	orig_tq_avg = router_orig->tq_avg;



	/* the TQ value has to be better */

	if (orig_tq_avg < gw_tq_avg)
@@ -243,18 +252,16 @@ void gw_check_election(struct bat_priv *bat_priv, struct orig_node *orig_node) 
		"Restarting gateway selection: better gateway found (tq curr: "

		"%i, tq new: %i)\n",

		gw_tq_avg, orig_tq_avg);

	goto deselect;



out_rcu:

	rcu_read_unlock();

	goto out;

deselect_rcu:

	rcu_read_unlock();

deselect:

	gw_deselect(bat_priv);

out:

	if (curr_gw_orig)

		orig_node_free_ref(curr_gw_orig);

	if (router_gw)

		neigh_node_free_ref(router_gw);

	if (router_orig)

		neigh_node_free_ref(router_orig);



	return;

}
@@ -362,23 +369,30 @@ void gw_node_purge(struct bat_priv *bat_priv) 
	spin_unlock_bh(&bat_priv->gw_list_lock);

}



/**

 * fails if orig_node has no router

 */

static int _write_buffer_text(struct bat_priv *bat_priv,

			      struct seq_file *seq, struct gw_node *gw_node)

{

	struct gw_node *curr_gw;

	int down, up, ret;

	struct neigh_node *router;

	int down, up, ret = -1;



	gw_bandwidth_to_kbit(gw_node->orig_node->gw_flags, &down, &up);



	router = orig_node_get_router(gw_node->orig_node);

	if (!router)

		goto out;



	rcu_read_lock();

	curr_gw = rcu_dereference(bat_priv->curr_gw);



	ret = seq_printf(seq, "%s %pM (%3i) %pM [%10s]: %3i - %i%s/%i%s\n",

		       (curr_gw == gw_node ? "=>" : "  "),

		       gw_node->orig_node->orig,

		       gw_node->orig_node->router->tq_avg,

		       gw_node->orig_node->router->addr,

		       gw_node->orig_node->router->if_incoming->net_dev->name,

		       router->tq_avg, router->addr,

		       router->if_incoming->net_dev->name,

		       gw_node->orig_node->gw_flags,

		       (down > 2048 ? down / 1024 : down),

		       (down > 2048 ? "MBit" : "KBit"),
@@ -386,6 +400,8 @@ static int _write_buffer_text(struct bat_priv *bat_priv, 
		       (up > 2048 ? "MBit" : "KBit"));



	rcu_read_unlock();

	neigh_node_free_ref(router);

out:

	return ret;

}
@@ -423,10 +439,10 @@ int gw_client_seq_print_text(struct seq_file *seq, void *offset) 
		if (gw_node->deleted)

			continue;



		if (!gw_node->orig_node->router)

		/* fails if orig_node has no router */

		if (_write_buffer_text(bat_priv, seq, gw_node) < 0)

			continue;



		_write_buffer_text(bat_priv, seq, gw_node);

		gw_count++;

	}

	rcu_read_unlock();

net/batman-adv/icmp_socket.c

+3 −15
Original line number Diff line number Diff line
@@ -218,23 +218,13 @@ static ssize_t bat_socket_write(struct file *file, const char __user *buff, 
	if (atomic_read(&bat_priv->mesh_state) != MESH_ACTIVE)

		goto dst_unreach;



	rcu_read_lock();

	orig_node = orig_hash_find(bat_priv, icmp_packet->dst);



	if (!orig_node)

		goto unlock;



	neigh_node = orig_node->router;

		goto dst_unreach;



	neigh_node = orig_node_get_router(orig_node);

	if (!neigh_node)

		goto unlock;



	if (!atomic_inc_not_zero(&neigh_node->refcount)) {

		neigh_node = NULL;

		goto unlock;

	}



	rcu_read_unlock();

		goto dst_unreach;



	if (!neigh_node->if_incoming)

		goto dst_unreach;
@@ -252,8 +242,6 @@ static ssize_t bat_socket_write(struct file *file, const char __user *buff, 
	send_skb_packet(skb, neigh_node->if_incoming, neigh_node->addr);

	goto out;



unlock:

	rcu_read_unlock();

dst_unreach:

	icmp_packet->msg_type = DESTINATION_UNREACHABLE;

	bat_socket_add_packet(socket_client, icmp_packet, packet_len);

net/batman-adv/originator.c

+28 −9
Original line number Diff line number Diff line
@@ -70,6 +70,21 @@ void neigh_node_free_ref(struct neigh_node *neigh_node) 
		call_rcu(&neigh_node->rcu, neigh_node_free_rcu);

}



/* increases the refcounter of a found router */

struct neigh_node *orig_node_get_router(struct orig_node *orig_node)

{

	struct neigh_node *router;



	rcu_read_lock();

	router = rcu_dereference(orig_node->router);



	if (router && !atomic_inc_not_zero(&router->refcount))

		router = NULL;



	rcu_read_unlock();

	return router;

}



struct neigh_node *create_neighbor(struct orig_node *orig_node,

				   struct orig_node *orig_neigh_node,

				   uint8_t *neigh,
@@ -390,7 +405,7 @@ int orig_seq_print_text(struct seq_file *seq, void *offset) 
	struct hlist_node *node, *node_tmp;

	struct hlist_head *head;

	struct orig_node *orig_node;

	struct neigh_node *neigh_node;

	struct neigh_node *neigh_node, *neigh_node_tmp;

	int batman_count = 0;

	int last_seen_secs;

	int last_seen_msecs;
@@ -421,37 +436,41 @@ int orig_seq_print_text(struct seq_file *seq, void *offset) 


		rcu_read_lock();

		hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {

			if (!orig_node->router)

			neigh_node = orig_node_get_router(orig_node);

			if (!neigh_node)

				continue;



			if (orig_node->router->tq_avg == 0)

				continue;

			if (neigh_node->tq_avg == 0)

				goto next;



			last_seen_secs = jiffies_to_msecs(jiffies -

						orig_node->last_valid) / 1000;

			last_seen_msecs = jiffies_to_msecs(jiffies -

						orig_node->last_valid) % 1000;



			neigh_node = orig_node->router;

			seq_printf(seq, "%pM %4i.%03is   (%3i) %pM [%10s]:",

				   orig_node->orig, last_seen_secs,

				   last_seen_msecs, neigh_node->tq_avg,

				   neigh_node->addr,

				   neigh_node->if_incoming->net_dev->name);



			hlist_for_each_entry_rcu(neigh_node, node_tmp,

			hlist_for_each_entry_rcu(neigh_node_tmp, node_tmp,

						 &orig_node->neigh_list, list) {

				seq_printf(seq, " %pM (%3i)", neigh_node->addr,

						neigh_node->tq_avg);

				seq_printf(seq, " %pM (%3i)",

					   neigh_node_tmp->addr,

					   neigh_node_tmp->tq_avg);

			}



			seq_printf(seq, "\n");

			batman_count++;



next:

			neigh_node_free_ref(neigh_node);

		}

		rcu_read_unlock();

	}



	if ((batman_count == 0))

	if (batman_count == 0)

		seq_printf(seq, "No batman nodes in range ...\n");



	return 0;

net/batman-adv/originator.h

+1 −0
Original line number Diff line number Diff line
@@ -34,6 +34,7 @@ struct neigh_node *create_neighbor(struct orig_node *orig_node, 
				   uint8_t *neigh,

				   struct hard_iface *if_incoming);

void neigh_node_free_ref(struct neigh_node *neigh_node);

struct neigh_node *orig_node_get_router(struct orig_node *orig_node);

int orig_seq_print_text(struct seq_file *seq, void *offset);

int orig_hash_add_if(struct hard_iface *hard_iface, int max_if_num);

int orig_hash_del_if(struct hard_iface *hard_iface, int max_if_num);

net/batman-adv/routing.c

+93 −101
Original line number Diff line number Diff line
@@ -87,10 +87,12 @@ static void update_route(struct bat_priv *bat_priv, 
			 struct neigh_node *neigh_node,

			 unsigned char *hna_buff, int hna_buff_len)

{

	struct neigh_node *neigh_node_tmp;

	struct neigh_node *curr_router;



	curr_router = orig_node_get_router(orig_node);



	/* route deleted */

	if ((orig_node->router) && (!neigh_node)) {

	if ((curr_router) && (!neigh_node)) {



		bat_dbg(DBG_ROUTES, bat_priv, "Deleting route towards: %pM\n",

			orig_node->orig);
@@ -98,7 +100,7 @@ static void update_route(struct bat_priv *bat_priv, 
				    "originator timed out");



	/* route added */

	} else if ((!orig_node->router) && (neigh_node)) {

	} else if ((!curr_router) && (neigh_node)) {



		bat_dbg(DBG_ROUTES, bat_priv,

			"Adding route towards: %pM (via %pM)\n",
@@ -112,15 +114,23 @@ static void update_route(struct bat_priv *bat_priv, 
			"Changing route towards: %pM "

			"(now via %pM - was via %pM)\n",

			orig_node->orig, neigh_node->addr,

			orig_node->router->addr);

			curr_router->addr);

	}



	if (curr_router)

		neigh_node_free_ref(curr_router);



	/* increase refcount of new best neighbor */

	if (neigh_node && !atomic_inc_not_zero(&neigh_node->refcount))

		neigh_node = NULL;

	neigh_node_tmp = orig_node->router;

	orig_node->router = neigh_node;

	if (neigh_node_tmp)

		neigh_node_free_ref(neigh_node_tmp);



	spin_lock_bh(&orig_node->neigh_list_lock);

	rcu_assign_pointer(orig_node->router, neigh_node);

	spin_unlock_bh(&orig_node->neigh_list_lock);



	/* decrease refcount of previous best neighbor */

	if (curr_router)

		neigh_node_free_ref(curr_router);

}
@@ -128,16 +138,23 @@ void update_routes(struct bat_priv *bat_priv, struct orig_node *orig_node, 
		   struct neigh_node *neigh_node, unsigned char *hna_buff,

		   int hna_buff_len)

{

	struct neigh_node *router = NULL;



	if (!orig_node)

		return;

		goto out;



	router = orig_node_get_router(orig_node);



	if (orig_node->router != neigh_node)

	if (router != neigh_node)

		update_route(bat_priv, orig_node, neigh_node,

			     hna_buff, hna_buff_len);

	/* may be just HNA changed */

	else

		update_HNA(bat_priv, orig_node, hna_buff, hna_buff_len);



out:

	if (router)

		neigh_node_free_ref(router);

}



static int is_bidirectional_neigh(struct orig_node *orig_node,
@@ -288,8 +305,8 @@ static void bonding_candidate_add(struct orig_node *orig_node, 
				  struct neigh_node *neigh_node)

{

	struct hlist_node *node;

	struct neigh_node *tmp_neigh_node;

	uint8_t best_tq, interference_candidate = 0;

	struct neigh_node *tmp_neigh_node, *router = NULL;

	uint8_t interference_candidate = 0;



	spin_lock_bh(&orig_node->neigh_list_lock);
@@ -298,13 +315,12 @@ static void bonding_candidate_add(struct orig_node *orig_node, 
			 neigh_node->orig_node->primary_addr))

		goto candidate_del;



	if (!orig_node->router)

	router = orig_node_get_router(orig_node);

	if (!router)

		goto candidate_del;



	best_tq = orig_node->router->tq_avg;



	/* ... and is good enough to be considered */

	if (neigh_node->tq_avg < best_tq - BONDING_TQ_THRESHOLD)

	if (neigh_node->tq_avg < router->tq_avg - BONDING_TQ_THRESHOLD)

		goto candidate_del;



	/**
@@ -350,7 +366,9 @@ static void bonding_candidate_add(struct orig_node *orig_node, 


out:

	spin_unlock_bh(&orig_node->neigh_list_lock);

	return;



	if (router)

		neigh_node_free_ref(router);

}



/* copy primary address for bonding */
@@ -373,6 +391,7 @@ static void update_orig(struct bat_priv *bat_priv, 
			char is_duplicate)

{

	struct neigh_node *neigh_node = NULL, *tmp_neigh_node = NULL;

	struct neigh_node *router = NULL;

	struct orig_node *orig_node_tmp;

	struct hlist_node *node;

	int tmp_hna_buff_len;
@@ -441,19 +460,18 @@ static void update_orig(struct bat_priv *bat_priv, 


	/* if this neighbor already is our next hop there is nothing

	 * to change */

	if (orig_node->router == neigh_node)

	router = orig_node_get_router(orig_node);

	if (router == neigh_node)

		goto update_hna;



	/* if this neighbor does not offer a better TQ we won't consider it */

	if ((orig_node->router) &&

	    (orig_node->router->tq_avg > neigh_node->tq_avg))

	if (router && (router->tq_avg > neigh_node->tq_avg))

		goto update_hna;



	/* if the TQ is the same and the link not more symetric we

	 * won't consider it either */

	if ((orig_node->router) &&

	     (neigh_node->tq_avg == orig_node->router->tq_avg)) {

		orig_node_tmp = orig_node->router->orig_node;

	if (router && (neigh_node->tq_avg == router->tq_avg)) {

		orig_node_tmp = router->orig_node;

		spin_lock_bh(&orig_node_tmp->ogm_cnt_lock);

		bcast_own_sum_orig =

			orig_node_tmp->bcast_own_sum[if_incoming->if_num];
@@ -474,7 +492,7 @@ static void update_orig(struct bat_priv *bat_priv, 
	goto update_gw;



update_hna:

	update_routes(bat_priv, orig_node, orig_node->router,

	update_routes(bat_priv, orig_node, router,

		      hna_buff, tmp_hna_buff_len);



update_gw:
@@ -496,6 +514,8 @@ static void update_orig(struct bat_priv *bat_priv, 
out:

	if (neigh_node)

		neigh_node_free_ref(neigh_node);

	if (router)

		neigh_node_free_ref(router);

}



/* checks whether the host restarted and is in the protection time.
@@ -603,6 +623,8 @@ void receive_bat_packet(struct ethhdr *ethhdr, 
	struct bat_priv *bat_priv = netdev_priv(if_incoming->soft_iface);

	struct hard_iface *hard_iface;

	struct orig_node *orig_neigh_node, *orig_node;

	struct neigh_node *router = NULL, *router_router = NULL;

	struct neigh_node *orig_neigh_router = NULL;

	char has_directlink_flag;

	char is_my_addr = 0, is_my_orig = 0, is_my_oldorig = 0;

	char is_broadcast = 0, is_bidirectional, is_single_hop_neigh;
@@ -747,14 +769,15 @@ void receive_bat_packet(struct ethhdr *ethhdr, 
		goto out;

	}



	router = orig_node_get_router(orig_node);

	if (router)

		router_router = orig_node_get_router(router->orig_node);



	/* avoid temporary routing loops */

	if ((orig_node->router) &&

	    (orig_node->router->orig_node->router) &&

	    (compare_eth(orig_node->router->addr,

			 batman_packet->prev_sender)) &&

	if (router && router_router &&

	    (compare_eth(router->addr, batman_packet->prev_sender)) &&

	    !(compare_eth(batman_packet->orig, batman_packet->prev_sender)) &&

	    (compare_eth(orig_node->router->addr,

			 orig_node->router->orig_node->router->addr))) {

	    (compare_eth(router->addr, router_router->addr))) {

		bat_dbg(DBG_BATMAN, bat_priv,

			"Drop packet: ignoring all rebroadcast packets that "

			"may make me loop (sender: %pM)\n", ethhdr->h_source);
@@ -769,9 +792,11 @@ void receive_bat_packet(struct ethhdr *ethhdr, 
	if (!orig_neigh_node)

		goto out;



	orig_neigh_router = orig_node_get_router(orig_neigh_node);



	/* drop packet if sender is not a direct neighbor and if we

	 * don't route towards it */

	if (!is_single_hop_neigh && (!orig_neigh_node->router)) {

	if (!is_single_hop_neigh && (!orig_neigh_router)) {

		bat_dbg(DBG_BATMAN, bat_priv,

			"Drop packet: OGM via unknown neighbor!\n");

		goto out_neigh;
@@ -825,6 +850,13 @@ void receive_bat_packet(struct ethhdr *ethhdr, 
	if ((orig_neigh_node) && (!is_single_hop_neigh))

		orig_node_free_ref(orig_neigh_node);

out:

	if (router)

		neigh_node_free_ref(router);

	if (router_router)

		neigh_node_free_ref(router_router);

	if (orig_neigh_router)

		neigh_node_free_ref(orig_neigh_router);



	orig_node_free_ref(orig_node);

}
@@ -869,7 +901,7 @@ static int recv_my_icmp_packet(struct bat_priv *bat_priv, 
			       struct sk_buff *skb, size_t icmp_len)

{

	struct orig_node *orig_node = NULL;

	struct neigh_node *neigh_node = NULL;

	struct neigh_node *router = NULL;

	struct icmp_packet_rr *icmp_packet;

	int ret = NET_RX_DROP;
@@ -886,23 +918,13 @@ static int recv_my_icmp_packet(struct bat_priv *bat_priv, 


	/* answer echo request (ping) */

	/* get routing information */

	rcu_read_lock();

	orig_node = orig_hash_find(bat_priv, icmp_packet->orig);



	if (!orig_node)

		goto unlock;



	neigh_node = orig_node->router;



	if (!neigh_node)

		goto unlock;



	if (!atomic_inc_not_zero(&neigh_node->refcount)) {

		neigh_node = NULL;

		goto unlock;

	}

		goto out;



	rcu_read_unlock();

	router = orig_node_get_router(orig_node);

	if (!router)

		goto out;



	/* create a copy of the skb, if needed, to modify it. */

	if (skb_cow(skb, sizeof(struct ethhdr)) < 0)
@@ -916,15 +938,12 @@ static int recv_my_icmp_packet(struct bat_priv *bat_priv, 
	icmp_packet->msg_type = ECHO_REPLY;

	icmp_packet->ttl = TTL;



	send_skb_packet(skb, neigh_node->if_incoming, neigh_node->addr);

	send_skb_packet(skb, router->if_incoming, router->addr);

	ret = NET_RX_SUCCESS;

	goto out;



unlock:

	rcu_read_unlock();

out:

	if (neigh_node)

		neigh_node_free_ref(neigh_node);

	if (router)

		neigh_node_free_ref(router);

	if (orig_node)

		orig_node_free_ref(orig_node);

	return ret;
@@ -934,7 +953,7 @@ static int recv_icmp_ttl_exceeded(struct bat_priv *bat_priv, 
				  struct sk_buff *skb)

{

	struct orig_node *orig_node = NULL;

	struct neigh_node *neigh_node = NULL;

	struct neigh_node *router = NULL;

	struct icmp_packet *icmp_packet;

	int ret = NET_RX_DROP;
@@ -952,23 +971,13 @@ static int recv_icmp_ttl_exceeded(struct bat_priv *bat_priv, 
		goto out;



	/* get routing information */

	rcu_read_lock();

	orig_node = orig_hash_find(bat_priv, icmp_packet->orig);



	if (!orig_node)

		goto unlock;



	neigh_node = orig_node->router;



	if (!neigh_node)

		goto unlock;



	if (!atomic_inc_not_zero(&neigh_node->refcount)) {

		neigh_node = NULL;

		goto unlock;

	}

		goto out;



	rcu_read_unlock();

	router = orig_node_get_router(orig_node);

	if (!router)

		goto out;



	/* create a copy of the skb, if needed, to modify it. */

	if (skb_cow(skb, sizeof(struct ethhdr)) < 0)
@@ -982,15 +991,12 @@ static int recv_icmp_ttl_exceeded(struct bat_priv *bat_priv, 
	icmp_packet->msg_type = TTL_EXCEEDED;

	icmp_packet->ttl = TTL;



	send_skb_packet(skb, neigh_node->if_incoming, neigh_node->addr);

	send_skb_packet(skb, router->if_incoming, router->addr);

	ret = NET_RX_SUCCESS;

	goto out;



unlock:

	rcu_read_unlock();

out:

	if (neigh_node)

		neigh_node_free_ref(neigh_node);

	if (router)

		neigh_node_free_ref(router);

	if (orig_node)

		orig_node_free_ref(orig_node);

	return ret;
@@ -1003,7 +1009,7 @@ int recv_icmp_packet(struct sk_buff *skb, struct hard_iface *recv_if) 
	struct icmp_packet_rr *icmp_packet;

	struct ethhdr *ethhdr;

	struct orig_node *orig_node = NULL;

	struct neigh_node *neigh_node = NULL;

	struct neigh_node *router = NULL;

	int hdr_size = sizeof(struct icmp_packet);

	int ret = NET_RX_DROP;
@@ -1050,23 +1056,13 @@ int recv_icmp_packet(struct sk_buff *skb, struct hard_iface *recv_if) 
		return recv_icmp_ttl_exceeded(bat_priv, skb);



	/* get routing information */

	rcu_read_lock();

	orig_node = orig_hash_find(bat_priv, icmp_packet->dst);



	if (!orig_node)

		goto unlock;



	neigh_node = orig_node->router;



	if (!neigh_node)

		goto unlock;



	if (!atomic_inc_not_zero(&neigh_node->refcount)) {

		neigh_node = NULL;

		goto unlock;

	}

		goto out;



	rcu_read_unlock();

	router = orig_node_get_router(orig_node);

	if (!router)

		goto out;



	/* create a copy of the skb, if needed, to modify it. */

	if (skb_cow(skb, sizeof(struct ethhdr)) < 0)
@@ -1078,15 +1074,12 @@ int recv_icmp_packet(struct sk_buff *skb, struct hard_iface *recv_if) 
	icmp_packet->ttl--;



	/* route it */

	send_skb_packet(skb, neigh_node->if_incoming, neigh_node->addr);

	send_skb_packet(skb, router->if_incoming, router->addr);

	ret = NET_RX_SUCCESS;

	goto out;



unlock:

	rcu_read_unlock();

out:

	if (neigh_node)

		neigh_node_free_ref(neigh_node);

	if (router)

		neigh_node_free_ref(router);

	if (orig_node)

		orig_node_free_ref(orig_node);

	return ret;
@@ -1208,7 +1201,8 @@ struct neigh_node *find_router(struct bat_priv *bat_priv, 
	if (!orig_node)

		return NULL;



	if (!orig_node->router)

	router = orig_node_get_router(orig_node);

	if (!router)

		return NULL;



	/* without bonding, the first node should
@@ -1217,9 +1211,8 @@ struct neigh_node *find_router(struct bat_priv *bat_priv, 


	rcu_read_lock();

	/* select default router to output */

	router = orig_node->router;

	router_orig = orig_node->router->orig_node;

	if (!router_orig || !atomic_inc_not_zero(&router->refcount)) {

	router_orig = router->orig_node;

	if (!router_orig) {

		rcu_read_unlock();

		return NULL;

	}
@@ -1251,7 +1244,6 @@ struct neigh_node *find_router(struct bat_priv *bat_priv, 
	if (atomic_read(&primary_orig_node->bond_candidates) < 2)

		goto return_router;





	/* all nodes between should choose a candidate which

	 * is is not on the interface where the packet came

	 * in. */