88 lines
2.9 KiB
Diff
88 lines
2.9 KiB
Diff
From: Sven Eckelmann <sven@narfation.org>
|
|
Date: Thu, 6 Sep 2018 14:35:25 +0200
|
|
Subject: batman-adv: Prevent duplicated nc_node entry
|
|
|
|
The function batadv_nc_get_nc_node is responsible for adding new nc_nodes
|
|
to the in_coding_list and out_coding_list. It first checks whether the
|
|
entry already is in the list or not. If it is, then the creation of a new
|
|
entry is aborted.
|
|
|
|
But the lock for the list is only held when the list is really modified.
|
|
This could lead to duplicated entries because another context could create
|
|
an entry with the same key between the check and the list manipulation.
|
|
|
|
The check and the manipulation of the list must therefore be in the same
|
|
locked code section.
|
|
|
|
Fixes: 3ed7ada3f0bb ("batman-adv: network coding - detect coding nodes and remove these after timeout")
|
|
Signed-off-by: Sven Eckelmann <sven@narfation.org>
|
|
Acked-by: Marek Lindner <mareklindner@neomailbox.ch>
|
|
|
|
Origin: upstream, https://git.open-mesh.org/batman-adv.git/commit/bab8447ad1850b25188f9652c0c52f8e58acd656
|
|
|
|
diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
|
|
index ab5a3bf0765f36f2fe14ff4a91d43d905e08a1f3..3279f7f3b97fd56535071b857cebebd68a5b3484 100644
|
|
--- a/net/batman-adv/network-coding.c
|
|
+++ b/net/batman-adv/network-coding.c
|
|
@@ -850,24 +850,6 @@ batadv_nc_get_nc_node(struct batadv_priv *bat_priv,
|
|
spinlock_t *lock; /* Used to lock list selected by "int in_coding" */
|
|
struct list_head *list;
|
|
|
|
- /* Check if nc_node is already added */
|
|
- nc_node = batadv_nc_find_nc_node(orig_node, orig_neigh_node, in_coding);
|
|
-
|
|
- /* Node found */
|
|
- if (nc_node)
|
|
- return nc_node;
|
|
-
|
|
- nc_node = kzalloc(sizeof(*nc_node), GFP_ATOMIC);
|
|
- if (!nc_node)
|
|
- return NULL;
|
|
-
|
|
- /* Initialize nc_node */
|
|
- INIT_LIST_HEAD(&nc_node->list);
|
|
- kref_init(&nc_node->refcount);
|
|
- ether_addr_copy(nc_node->addr, orig_node->orig);
|
|
- kref_get(&orig_neigh_node->refcount);
|
|
- nc_node->orig_node = orig_neigh_node;
|
|
-
|
|
/* Select ingoing or outgoing coding node */
|
|
if (in_coding) {
|
|
lock = &orig_neigh_node->in_coding_list_lock;
|
|
@@ -877,13 +859,34 @@ batadv_nc_get_nc_node(struct batadv_priv *bat_priv,
|
|
list = &orig_neigh_node->out_coding_list;
|
|
}
|
|
|
|
+ spin_lock_bh(lock);
|
|
+
|
|
+ /* Check if nc_node is already added */
|
|
+ nc_node = batadv_nc_find_nc_node(orig_node, orig_neigh_node, in_coding);
|
|
+
|
|
+ /* Node found */
|
|
+ if (nc_node)
|
|
+ goto unlock;
|
|
+
|
|
+ nc_node = kzalloc(sizeof(*nc_node), GFP_ATOMIC);
|
|
+ if (!nc_node)
|
|
+ goto unlock;
|
|
+
|
|
+ /* Initialize nc_node */
|
|
+ INIT_LIST_HEAD(&nc_node->list);
|
|
+ kref_init(&nc_node->refcount);
|
|
+ ether_addr_copy(nc_node->addr, orig_node->orig);
|
|
+ kref_get(&orig_neigh_node->refcount);
|
|
+ nc_node->orig_node = orig_neigh_node;
|
|
+
|
|
batadv_dbg(BATADV_DBG_NC, bat_priv, "Adding nc_node %pM -> %pM\n",
|
|
nc_node->addr, nc_node->orig_node->orig);
|
|
|
|
/* Add nc_node to orig_node */
|
|
- spin_lock_bh(lock);
|
|
kref_get(&nc_node->refcount);
|
|
list_add_tail_rcu(&nc_node->list, list);
|
|
+
|
|
+unlock:
|
|
spin_unlock_bh(lock);
|
|
|
|
return nc_node;
|