Commit 377fe0f968b30a1a714fab53a908061914f30e26
Committed by
Antonio Quartulli
1 parent
be181015a1
batman-adv: increase orig refcount when storing ref in gw_node
A pointer to the orig_node representing a bat-gateway is stored in the gw_node->orig_node member, but the refcount for such orig_node is never increased. This leads to memory faults when gw_node->orig_node is accessed and the originator has already been freed. Fix this by increasing the refcount on gw_node creation and decreasing it on gw_node free. Signed-off-by: Antonio Quartulli <antonio@open-mesh.com> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Showing 1 changed file with 9 additions and 2 deletions Side-by-side Diff
net/batman-adv/gateway_client.c
... | ... | @@ -42,8 +42,10 @@ |
42 | 42 | |
43 | 43 | static void batadv_gw_node_free_ref(struct batadv_gw_node *gw_node) |
44 | 44 | { |
45 | - if (atomic_dec_and_test(&gw_node->refcount)) | |
45 | + if (atomic_dec_and_test(&gw_node->refcount)) { | |
46 | + batadv_orig_node_free_ref(gw_node->orig_node); | |
46 | 47 | kfree_rcu(gw_node, rcu); |
48 | + } | |
47 | 49 | } |
48 | 50 | |
49 | 51 | static struct batadv_gw_node * |
50 | 52 | |
51 | 53 | |
... | ... | @@ -406,9 +408,14 @@ |
406 | 408 | if (gateway->bandwidth_down == 0) |
407 | 409 | return; |
408 | 410 | |
411 | + if (!atomic_inc_not_zero(&orig_node->refcount)) | |
412 | + return; | |
413 | + | |
409 | 414 | gw_node = kzalloc(sizeof(*gw_node), GFP_ATOMIC); |
410 | - if (!gw_node) | |
415 | + if (!gw_node) { | |
416 | + batadv_orig_node_free_ref(orig_node); | |
411 | 417 | return; |
418 | + } | |
412 | 419 | |
413 | 420 | INIT_HLIST_NODE(&gw_node->list); |
414 | 421 | gw_node->orig_node = orig_node; |