batman-adv: stop caching unowned originator pointers in BAT IV

BAT IV keeps the last-hop neighbor address in each neigh_node, but some
paths also cache an originator pointer derived from a temporary lookup.
That pointer is not owned by the neigh_node and may no longer refer to a
live originator entry after purge handling runs.

Stop storing the auxiliary originator pointer in the BAT IV neighbor
state. When BAT IV needs the neighbor originator data, resolve it from
the stored neighbor address and drop the reference again after use.

Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Cc: stable@kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Jiexun Wang <wangjiexun2025@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
[sven: avoid bonding logic for outgoing OGM]
Signed-off-by: Sven Eckelmann <sven@narfation.org>

diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 618d1889c04e75b95167b7aea39347d719a4f141..74ef7dc2b2f981061fbe3c76a3f8c4aa2b07d320 100644 (file)
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -173,19 +173,12 @@ free_orig_node_hash:
 static struct batadv_neigh_node *
 batadv_iv_ogm_neigh_new(struct batadv_hard_iface *hard_iface,
                        const u8 *neigh_addr,
-                       struct batadv_orig_node *orig_node,
-                       struct batadv_orig_node *orig_neigh)
+                       struct batadv_orig_node *orig_node)
 {
        struct batadv_neigh_node *neigh_node;
 
        neigh_node = batadv_neigh_node_get_or_create(orig_node,
                                                     hard_iface, neigh_addr);
-       if (!neigh_node)
-               goto out;
-
-       neigh_node->orig_node = orig_neigh;
-
-out:
        return neigh_node;
 }
 
@@ -906,6 +899,31 @@ static u8 batadv_iv_orig_ifinfo_sum(struct batadv_orig_node *orig_node,
        return sum;
 }
 
+/**
+ * batadv_iv_ogm_neigh_ifinfo_sum() - Get bcast_own sum for a last-hop neighbor
+ * @bat_priv: the bat priv with all the mesh interface information
+ * @neigh_node: last-hop neighbor of an originator
+ *
+ * Return: Number of replied (rebroadcasted) OGMs for the originator currently
+ * announced by the neighbor. Returns 0 if the neighbor's originator entry is
+ * not available anymore.
+ */
+static u8 batadv_iv_ogm_neigh_ifinfo_sum(struct batadv_priv *bat_priv,
+                                        const struct batadv_neigh_node *neigh_node)
+{
+       struct batadv_orig_node *orig_neigh;
+       u8 sum;
+
+       orig_neigh = batadv_orig_hash_find(bat_priv, neigh_node->addr);
+       if (!orig_neigh)
+               return 0;
+
+       sum = batadv_iv_orig_ifinfo_sum(orig_neigh, neigh_node->if_incoming);
+       batadv_orig_node_put(orig_neigh);
+
+       return sum;
+}
+
 /**
  * batadv_iv_ogm_orig_update() - use OGM to update corresponding data in an
  *  originator
@@ -975,17 +993,9 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv,
        }
 
        if (!neigh_node) {
-               struct batadv_orig_node *orig_tmp;
-
-               orig_tmp = batadv_iv_ogm_orig_get(bat_priv, ethhdr->h_source);
-               if (!orig_tmp)
-                       goto unlock;
-
                neigh_node = batadv_iv_ogm_neigh_new(if_incoming,
                                                     ethhdr->h_source,
-                                                    orig_node, orig_tmp);
-
-               batadv_orig_node_put(orig_tmp);
+                                                    orig_node);
                if (!neigh_node)
                        goto unlock;
        } else {
@@ -1037,10 +1047,9 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv,
         */
        if (router_ifinfo &&
            neigh_ifinfo->bat_iv.tq_avg == router_ifinfo->bat_iv.tq_avg) {
-               sum_orig = batadv_iv_orig_ifinfo_sum(router->orig_node,
-                                                    router->if_incoming);
-               sum_neigh = batadv_iv_orig_ifinfo_sum(neigh_node->orig_node,
-                                                     neigh_node->if_incoming);
+               sum_orig = batadv_iv_ogm_neigh_ifinfo_sum(bat_priv, router);
+               sum_neigh = batadv_iv_ogm_neigh_ifinfo_sum(bat_priv,
+                                                          neigh_node);
                if (sum_orig >= sum_neigh)
                        goto out;
        }
@@ -1106,7 +1115,6 @@ static bool batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node,
        if (!neigh_node)
                neigh_node = batadv_iv_ogm_neigh_new(if_incoming,
                                                     orig_neigh_node->orig,
-                                                    orig_neigh_node,
                                                     orig_neigh_node);
 
        if (!neigh_node)
@@ -1302,6 +1310,32 @@ out:
        return ret;
 }
 
+/**
+ * batadv_orig_to_direct_router() - get direct next hop neighbor to an orig address
+ * @bat_priv: the bat priv with all the mesh interface information
+ * @orig_addr: the originator MAC address to search the best next hop router for
+ * @if_outgoing: the interface where the OGM should be sent to
+ *
+ * Return: A neighbor node which is the best router towards the given originator
+ * address. Bonding candidates are ignored.
+ */
+static struct batadv_neigh_node *
+batadv_orig_to_direct_router(struct batadv_priv *bat_priv, u8 *orig_addr,
+                            struct batadv_hard_iface *if_outgoing)
+{
+       struct batadv_neigh_node *neigh_node;
+       struct batadv_orig_node *orig_node;
+
+       orig_node = batadv_orig_hash_find(bat_priv, orig_addr);
+       if (!orig_node)
+               return NULL;
+
+       neigh_node = batadv_orig_router_get(orig_node, if_outgoing);
+       batadv_orig_node_put(orig_node);
+
+       return neigh_node;
+}
+
 /**
  * batadv_iv_ogm_process_per_outif() - process a batman iv OGM for an outgoing
  *  interface
@@ -1372,8 +1406,9 @@ batadv_iv_ogm_process_per_outif(const struct sk_buff *skb, int ogm_offset,
 
        router = batadv_orig_router_get(orig_node, if_outgoing);
        if (router) {
-               router_router = batadv_orig_router_get(router->orig_node,
-                                                      if_outgoing);
+               router_router = batadv_orig_to_direct_router(bat_priv,
+                                                            router->addr,
+                                                            if_outgoing);
                router_ifinfo = batadv_neigh_ifinfo_get(router, if_outgoing);
        }