batman-adv: protect neighbor nodes with reference counters

Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 54863c9385de00ec8346d94ccfea96e76593af23..b1b1773afa0b26e045c4d59589831b9d7b0e2573 100644 (file)
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -59,9 +59,18 @@ err:
        return 0;
 }
 
-struct neigh_node *
-create_neighbor(struct orig_node *orig_node, struct orig_node *orig_neigh_node,
-               uint8_t *neigh, struct batman_if *if_incoming)
+void neigh_node_free_ref(struct kref *refcount)
+{
+       struct neigh_node *neigh_node;
+
+       neigh_node = container_of(refcount, struct neigh_node, refcount);
+       kfree(neigh_node);
+}
+
+struct neigh_node *create_neighbor(struct orig_node *orig_node,
+                                  struct orig_node *orig_neigh_node,
+                                  uint8_t *neigh,
+                                  struct batman_if *if_incoming)
 {
        struct bat_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
        struct neigh_node *neigh_node;
@@ -78,6 +87,7 @@ create_neighbor(struct orig_node *orig_node, struct orig_node *orig_neigh_node,
        memcpy(neigh_node->addr, neigh, ETH_ALEN);
        neigh_node->orig_node = orig_neigh_node;
        neigh_node->if_incoming = if_incoming;
+       kref_init(&neigh_node->refcount);
 
        list_add_tail(&neigh_node->list, &orig_node->neigh_list);
        return neigh_node;
@@ -95,7 +105,7 @@ static void free_orig_node(void *data, void *arg)
                neigh_node = list_entry(list_pos, struct neigh_node, list);
 
                list_del(list_pos);
-               kfree(neigh_node);
+               kref_put(&neigh_node->refcount, neigh_node_free_ref);
        }
 
        frag_list_free(&orig_node->frag_list);
@@ -216,7 +226,7 @@ static bool purge_orig_neighbors(struct bat_priv *bat_priv,
 
                        neigh_purged = true;
                        list_del(list_pos);
-                       kfree(neigh_node);
+                       kref_put(&neigh_node->refcount, neigh_node_free_ref);
                } else {
                        if ((!*best_neigh_node) ||
                            (neigh_node->tq_avg > (*best_neigh_node)->tq_avg))

diff --git a/net/batman-adv/originator.h b/net/batman-adv/originator.h
index 8019fbddffd03eab2f462988dd968e5be3391942..88e5c6049243001ac7d11dd25895b3770bf78d27 100644 (file)
--- a/net/batman-adv/originator.h
+++ b/net/batman-adv/originator.h
@@ -26,9 +26,11 @@ int originator_init(struct bat_priv *bat_priv);
 void originator_free(struct bat_priv *bat_priv);
 void purge_orig_ref(struct bat_priv *bat_priv);
 struct orig_node *get_orig_node(struct bat_priv *bat_priv, uint8_t *addr);
-struct neigh_node *
-create_neighbor(struct orig_node *orig_node, struct orig_node *orig_neigh_node,
-               uint8_t *neigh, struct batman_if *if_incoming);
+struct neigh_node *create_neighbor(struct orig_node *orig_node,
+                                  struct orig_node *orig_neigh_node,
+                                  uint8_t *neigh,
+                                  struct batman_if *if_incoming);
+void neigh_node_free_ref(struct kref *refcount);
 int orig_seq_print_text(struct seq_file *seq, void *offset);
 int orig_hash_add_if(struct batman_if *batman_if, int max_if_num);
 int orig_hash_del_if(struct batman_if *batman_if, int max_if_num);

diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 827414067e461f88a546620af343380121c66cc9..36351d374f2898aca67afa601c1d7233c9c7e0c1 100644 (file)
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -89,6 +89,8 @@ static void update_route(struct bat_priv *bat_priv,
                         struct neigh_node *neigh_node,
                         unsigned char *hna_buff, int hna_buff_len)
 {
+       struct neigh_node *neigh_node_tmp;
+
        /* route deleted */
        if ((orig_node->router) && (!neigh_node)) {
 
@@ -115,7 +117,12 @@ static void update_route(struct bat_priv *bat_priv,
                        orig_node->router->addr);
        }
 
+       if (neigh_node)
+               kref_get(&neigh_node->refcount);
+       neigh_node_tmp = orig_node->router;
        orig_node->router = neigh_node;
+       if (neigh_node_tmp)
+               kref_put(&neigh_node_tmp->refcount, neigh_node_free_ref);
 }
 
 

diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index 7270405046e98cfa6c4c9ad18e69aba575cd72f1..f9217d5dad8e1d8595e323f68b03453b7151d04c 100644 (file)
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -115,6 +115,7 @@ struct neigh_node {
        struct neigh_node *next_bond_candidate;
        unsigned long last_valid;
        unsigned long real_bits[NUM_WORDS];
+       struct kref refcount;
        struct orig_node *orig_node;
        struct batman_if *if_incoming;
 };