batman-adv/patches/0009-batman-adv-increase-orig-refcount-when-storing-ref-i.patch

   1 From 8dbdee55810adceecf51548d44da893076c99219 Mon Sep 17 00:00:00 2001
   2 From: Antonio Quartulli <antonio@open-mesh.com>
   3 Date: Fri, 2 May 2014 01:35:13 +0200
   4 Subject: [PATCH 9/9] batman-adv: increase orig refcount when storing ref in
   5  gw_node
   6
   7 A pointer to the orig_node representing a bat-gateway is
   8 stored in the gw_node->orig_node member, but the refcount
   9 for such orig_node is never increased.
  10 This leads to memory faults when gw_node->orig_node is accessed
  11 and the originator has already been freed.
  12
  13 Fix this by increasing the refcount on gw_node creation
  14 and decreasing it on gw_node free.
  15
  16 Signed-off-by: Antonio Quartulli <antonio@open-mesh.com>
  17 Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
  18 ---
  19  gateway_client.c | 11 +++++++++--
  20  1 file changed, 9 insertions(+), 2 deletions(-)
  21
  22 diff --git a/gateway_client.c b/gateway_client.c
  23 index d7fafc1..d5a40ab 100644
  24 --- a/gateway_client.c
  25 +++ b/gateway_client.c
  26 @@ -42,8 +42,10 @@
  27
  28  static void batadv_gw_node_free_ref(struct batadv_gw_node *gw_node)
  29  {
  30 -       if (atomic_dec_and_test(&gw_node->refcount))
  31 +       if (atomic_dec_and_test(&gw_node->refcount)) {
  32 +               batadv_orig_node_free_ref(gw_node->orig_node);
  33                 kfree_rcu(gw_node, rcu);
  34 +       }
  35  }
  36
  37  static struct batadv_gw_node *
  38 @@ -406,9 +408,14 @@ static void batadv_gw_node_add(struct batadv_priv *bat_priv,
  39         if (gateway->bandwidth_down == 0)
  40                 return;
  41
  42 +       if (!atomic_inc_not_zero(&orig_node->refcount))
  43 +               return;
  44 +
  45         gw_node = kzalloc(sizeof(*gw_node), GFP_ATOMIC);
  46 -       if (!gw_node)
  47 +       if (!gw_node) {
  48 +               batadv_orig_node_free_ref(orig_node);
  49                 return;
  50 +       }
  51
  52         INIT_HLIST_NODE(&gw_node->list);
  53         gw_node->orig_node = orig_node;
  54 --
  55 2.0.0.rc2
  56