batman-adv: Make orig_node->router an rcu protected pointer
The rcu protected macros rcu_dereference() and rcu_assign_pointer()
for the orig_node->router need to be used, as well as spin/rcu locking.
Otherwise we might end up using a router pointer pointing to already
freed memory.
Therefore this commit introduces the safe getter method
orig_node_get_router().
Signed-off-by: Linus Lüssing <linus.luessing@web.de>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index d49e54d..e78670c 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -308,6 +308,7 @@
struct hard_iface *if_incoming)
{
struct bat_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
+ struct neigh_node *router;
unsigned char in_tq, in_ttl, tq_avg = 0;
unsigned long send_time;
@@ -316,6 +317,8 @@
return;
}
+ router = orig_node_get_router(orig_node);
+
in_tq = batman_packet->tq;
in_ttl = batman_packet->ttl;
@@ -324,20 +327,22 @@
/* rebroadcast tq of our best ranking neighbor to ensure the rebroadcast
* of our best tq value */
- if ((orig_node->router) && (orig_node->router->tq_avg != 0)) {
+ if (router && router->tq_avg != 0) {
/* rebroadcast ogm of best ranking neighbor as is */
- if (!compare_eth(orig_node->router->addr, ethhdr->h_source)) {
- batman_packet->tq = orig_node->router->tq_avg;
+ if (!compare_eth(router->addr, ethhdr->h_source)) {
+ batman_packet->tq = router->tq_avg;
- if (orig_node->router->last_ttl)
- batman_packet->ttl = orig_node->router->last_ttl
- - 1;
+ if (router->last_ttl)
+ batman_packet->ttl = router->last_ttl - 1;
}
- tq_avg = orig_node->router->tq_avg;
+ tq_avg = router->tq_avg;
}
+ if (router)
+ neigh_node_free_ref(router);
+
/* apply hop penalty */
batman_packet->tq = hop_penalty(batman_packet->tq, bat_priv);