Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5ba7dcfe authored by Sven Eckelmann's avatar Sven Eckelmann Committed by Simon Wunderlich
Browse files

batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq 



The originator node object orig_neigh_node is used to when accessing the
bcast_own(_sum) and real_packet_count information. The access to them has
to be protected with the spinlock in orig_neigh_node.

But the function uses the lock in orig_node instead. This is incorrect
because they could be two different originator node objects.

Fixes: 0ede9f41 ("batman-adv: protect bit operations to count OGMs with spinlock")
Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
Signed-off-by: default avatarSimon Wunderlich <sw@simonwunderlich.de>
parent 974a6b20

net/batman-adv/bat_iv_ogm.c

+2 −2
Original line number Diff line number Diff line
@@ -1214,7 +1214,7 @@ static bool batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node, 
	orig_node->last_seen = jiffies;



	/* find packet count of corresponding one hop neighbor */

	spin_lock_bh(&orig_node->bat_iv.ogm_cnt_lock);

	spin_lock_bh(&orig_neigh_node->bat_iv.ogm_cnt_lock);

	if_num = if_incoming->if_num;

	orig_eq_count = orig_neigh_node->bat_iv.bcast_own_sum[if_num];

	neigh_ifinfo = batadv_neigh_ifinfo_new(neigh_node, if_outgoing);
@@ -1224,7 +1224,7 @@ static bool batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node, 
	} else {

		neigh_rq_count = 0;

	}

	spin_unlock_bh(&orig_node->bat_iv.ogm_cnt_lock);

	spin_unlock_bh(&orig_neigh_node->bat_iv.ogm_cnt_lock);



	/* pay attention to not get a value bigger than 100 % */

	if (orig_eq_count > neigh_rq_count)