diff options
| author | Simon Wunderlich <simon@open-mesh.com> | 2014-03-26 15:46:22 +0100 |
|---|---|---|
| committer | Antonio Quartulli <antonio@meshcoding.com> | 2014-05-10 10:58:45 +0200 |
| commit | 000c8dff97311357535d64539e58990526e4de70 (patch) | |
| tree | 5193950037c3ef3433a271b579dd3c5583bae19b /net/batman-adv | |
| parent | c1e517fbbcdb13f50662af4edc11c3251fe44f86 (diff) | |
| download | linux-rpi3-000c8dff97311357535d64539e58990526e4de70.tar.gz linux-rpi3-000c8dff97311357535d64539e58990526e4de70.tar.bz2 linux-rpi3-000c8dff97311357535d64539e58990526e4de70.zip | |
batman-adv: fix neigh reference imbalance
When an interface is removed from batman-adv, the orig_ifinfo of a
orig_node may be removed without releasing the router first.
This will prevent the reference for the neighbor pointed at by the
orig_ifinfo->router to be released, and this leak may result in
reference leaks for the interface used by this neighbor. Fix that.
This is a regression introduced by
7351a4822d42827ba0110677c0cbad88a3d52585
("batman-adv: split out router from orig_node").
Reported-by: Antonio Quartulli <antonio@open-mesh.com>
Signed-off-by: Simon Wunderlich <simon@open-mesh.com>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>
Diffstat (limited to 'net/batman-adv')
| -rw-r--r-- | net/batman-adv/originator.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c index ffd9dfbd9b0e..a43da6918512 100644 --- a/net/batman-adv/originator.c +++ b/net/batman-adv/originator.c @@ -501,12 +501,17 @@ batadv_neigh_node_get(const struct batadv_orig_node *orig_node, static void batadv_orig_ifinfo_free_rcu(struct rcu_head *rcu) { struct batadv_orig_ifinfo *orig_ifinfo; + struct batadv_neigh_node *router; orig_ifinfo = container_of(rcu, struct batadv_orig_ifinfo, rcu); if (orig_ifinfo->if_outgoing != BATADV_IF_DEFAULT) batadv_hardif_free_ref_now(orig_ifinfo->if_outgoing); + /* this is the last reference to this object */ + router = rcu_dereference_protected(orig_ifinfo->router, true); + if (router) + batadv_neigh_node_free_ref_now(router); kfree(orig_ifinfo); } |