releases/4.9.135/batman-adv-prevent-duplicated-nc_node-entry.patch

   1 From foo@baz Thu Oct 18 11:11:32 CEST 2018
   2 From: Sven Eckelmann <sven@narfation.org>
   3 Date: Sun, 12 Aug 2018 21:04:42 +0200
   4 Subject: batman-adv: Prevent duplicated nc_node entry
   5
   6 From: Sven Eckelmann <sven@narfation.org>
   7
   8 [ Upstream commit fa122fec8640eb7186ce5a41b83a4c1744ceef8f ]
   9
  10 The function batadv_nc_get_nc_node is responsible for adding new nc_nodes
  11 to the in_coding_list and out_coding_list. It first checks whether the
  12 entry already is in the list or not. If it is, then the creation of a new
  13 entry is aborted.
  14
  15 But the lock for the list is only held when the list is really modified.
  16 This could lead to duplicated entries because another context could create
  17 an entry with the same key between the check and the list manipulation.
  18
  19 The check and the manipulation of the list must therefore be in the same
  20 locked code section.
  21
  22 Fixes: d56b1705e28c ("batman-adv: network coding - detect coding nodes and remove these after timeout")
  23 Signed-off-by: Sven Eckelmann <sven@narfation.org>
  24 Acked-by: Marek Lindner <mareklindner@neomailbox.ch>
  25 Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
  26 Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
  27 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  28 ---
  29  net/batman-adv/network-coding.c |   27 +++++++++++++++------------
  30  1 file changed, 15 insertions(+), 12 deletions(-)
  31
  32 --- a/net/batman-adv/network-coding.c
  33 +++ b/net/batman-adv/network-coding.c
  34 @@ -845,16 +845,27 @@ batadv_nc_get_nc_node(struct batadv_priv
  35         spinlock_t *lock; /* Used to lock list selected by "int in_coding" */
  36         struct list_head *list;
  37
  38 +       /* Select ingoing or outgoing coding node */
  39 +       if (in_coding) {
  40 +               lock = &orig_neigh_node->in_coding_list_lock;
  41 +               list = &orig_neigh_node->in_coding_list;
  42 +       } else {
  43 +               lock = &orig_neigh_node->out_coding_list_lock;
  44 +               list = &orig_neigh_node->out_coding_list;
  45 +       }
  46 +
  47 +       spin_lock_bh(lock);
  48 +
  49         /* Check if nc_node is already added */
  50         nc_node = batadv_nc_find_nc_node(orig_node, orig_neigh_node, in_coding);
  51
  52         /* Node found */
  53         if (nc_node)
  54 -               return nc_node;
  55 +               goto unlock;
  56
  57         nc_node = kzalloc(sizeof(*nc_node), GFP_ATOMIC);
  58         if (!nc_node)
  59 -               return NULL;
  60 +               goto unlock;
  61
  62         /* Initialize nc_node */
  63         INIT_LIST_HEAD(&nc_node->list);
  64 @@ -863,22 +874,14 @@ batadv_nc_get_nc_node(struct batadv_priv
  65         kref_get(&orig_neigh_node->refcount);
  66         nc_node->orig_node = orig_neigh_node;
  67
  68 -       /* Select ingoing or outgoing coding node */
  69 -       if (in_coding) {
  70 -               lock = &orig_neigh_node->in_coding_list_lock;
  71 -               list = &orig_neigh_node->in_coding_list;
  72 -       } else {
  73 -               lock = &orig_neigh_node->out_coding_list_lock;
  74 -               list = &orig_neigh_node->out_coding_list;
  75 -       }
  76 -
  77         batadv_dbg(BATADV_DBG_NC, bat_priv, "Adding nc_node %pM -> %pM\n",
  78                    nc_node->addr, nc_node->orig_node->orig);
  79
  80         /* Add nc_node to orig_node */
  81 -       spin_lock_bh(lock);
  82         kref_get(&nc_node->refcount);
  83         list_add_tail_rcu(&nc_node->list, list);
  84 +
  85 +unlock:
  86         spin_unlock_bh(lock);
  87
  88         return nc_node;