batman-adv: Fix reference counting of vlan object for tt_local_entry
authorSven Eckelmann <sven@narfation.org>
Fri, 11 Mar 2016 15:44:05 +0000 (16:44 +0100)
committerAntonio Quartulli <a@unstable.cc>
Fri, 29 Apr 2016 11:46:11 +0000 (19:46 +0800)
commita33d970d0b54b09746d5540af8271fad4eb10229
treec99d0686e3883e9086d926ea762c6d3068653b8d
parentb6cf5d499fddbfcffe751e81fb9f1a07d6348026
batman-adv: Fix reference counting of vlan object for tt_local_entry

The batadv_tt_local_entry was specific to a batadv_softif_vlan and held an
implicit reference to it. But this reference was never stored in form of a
pointer in the tt_local_entry itself. Instead batadv_tt_local_remove,
batadv_tt_local_table_free and batadv_tt_local_purge_pending_clients depend
on a consistent state of bat_priv->softif_vlan_list and that
batadv_softif_vlan_get always returns the batadv_softif_vlan object which
it has a reference for. But batadv_softif_vlan_get cannot guarantee that
because it is working only with rcu_read_lock on this list. It can
therefore happen that an vid is in this list twice or that
batadv_softif_vlan_get cannot find the batadv_softif_vlan for an vid due to
some other list operations taking place at the same time.

Instead add a batadv_softif_vlan pointer directly in batadv_tt_local_entry
which will be used for the reference counter decremented on release of
batadv_tt_local_entry.

Fixes: 35df3b298fc8 ("batman-adv: fix TT VLAN inconsistency on VLAN re-add")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Acked-by: Antonio Quartulli <a@unstable.cc>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Antonio Quartulli <a@unstable.cc>
net/batman-adv/translation-table.c
net/batman-adv/types.h