From dd58ddc6928f711d8fb7101182215a0f23cf41f1 Mon Sep 17 00:00:00 2001 From: Linus Lüssing Date: Tue, 25 Jan 2011 21:56:16 +0000 Subject: batman-adv: Fix kernel panic when fetching vis data on a vis server MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The hash_iterate removal introduced a bug leading to a kernel panic when fetching the vis data on a vis server. That commit forgot to rename one variable name, which this commit fixes now. Reported-by: Russell Senior Signed-off-by: Linus Lüssing Signed-off-by: Sven Eckelmann --- net/batman-adv/vis.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'net') diff --git a/net/batman-adv/vis.c b/net/batman-adv/vis.c index cd4c4231fa48..f69a3748f8ae 100644 --- a/net/batman-adv/vis.c +++ b/net/batman-adv/vis.c @@ -268,10 +268,10 @@ int vis_seq_print_text(struct seq_file *seq, void *offset) buff_pos += sprintf(buff + buff_pos, "%pM,", entry->addr); - for (i = 0; i < packet->entries; i++) + for (j = 0; j < packet->entries; j++) buff_pos += vis_data_read_entry( buff + buff_pos, - &entries[i], + &entries[j], entry->addr, entry->primary); -- cgit v1.2.3 From 2674c15870f888cb732a564fc504ce17654afc64 Mon Sep 17 00:00:00 2001 From: Sven Eckelmann Date: Fri, 28 Jan 2011 18:34:05 +0100 Subject: batman-adv: Remove vis info on hashing errors A newly created vis info object must be removed when it couldn't be added to the hash. The old_info which has to be replaced was already removed and isn't related to the hash anymore. Signed-off-by: Sven Eckelmann --- net/batman-adv/vis.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'net') diff --git a/net/batman-adv/vis.c b/net/batman-adv/vis.c index f69a3748f8ae..0be55beba054 100644 --- a/net/batman-adv/vis.c +++ b/net/batman-adv/vis.c @@ -444,7 +444,7 @@ static struct vis_info *add_packet(struct bat_priv *bat_priv, info); if (hash_added < 0) { /* did not work (for some reason) */ - kref_put(&old_info->refcount, free_info); + kref_put(&info->refcount, free_info); info = NULL; } -- cgit v1.2.3 From dda9fc6b2c59f056e7a2b313b8423b14a4df25a9 Mon Sep 17 00:00:00 2001 From: Sven Eckelmann Date: Fri, 28 Jan 2011 18:34:06 +0100 Subject: batman-adv: Remove vis info element in free_info The free_info function will be called when no reference to the info object exists anymore. It must be ensured that the allocated memory gets freed and not only the elements which are managed by the info object. Signed-off-by: Sven Eckelmann --- net/batman-adv/vis.c | 1 + 1 file changed, 1 insertion(+) (limited to 'net') diff --git a/net/batman-adv/vis.c b/net/batman-adv/vis.c index 0be55beba054..988296cdf7c5 100644 --- a/net/batman-adv/vis.c +++ b/net/batman-adv/vis.c @@ -64,6 +64,7 @@ static void free_info(struct kref *ref) spin_unlock_bh(&bat_priv->vis_list_lock); kfree_skb(info->skb_packet); + kfree(info); } /* Compare two vis packets, used by the hashing algorithm */ -- cgit v1.2.3 From 1181e1daace88018b2ff66592aa10a4791d705ff Mon Sep 17 00:00:00 2001 From: Sven Eckelmann Date: Fri, 28 Jan 2011 18:34:07 +0100 Subject: batman-adv: Make vis info stack traversal threadsafe The batman-adv vis server has to a stack which stores all information about packets which should be send later. This stack is protected with a spinlock that is used to prevent concurrent write access to it. The send_vis_packets function has to take all elements from the stack and send them to other hosts over the primary interface. The send will be initiated without the lock which protects the stack. The implementation using list_for_each_entry_safe has the problem that it stores the next element as "safe ptr" to allow the deletion of the current element in the list. The list may be modified during the unlock/lock pair in the loop body which may make the safe pointer not pointing to correct next element. It is safer to remove and use the first element from the stack until no elements are available. This does not need reduntant information which would have to be validated each time the lock was removed. Reported-by: Russell Senior Signed-off-by: Sven Eckelmann --- net/batman-adv/vis.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'net') diff --git a/net/batman-adv/vis.c b/net/batman-adv/vis.c index 988296cdf7c5..de1022cacaf7 100644 --- a/net/batman-adv/vis.c +++ b/net/batman-adv/vis.c @@ -816,7 +816,7 @@ static void send_vis_packets(struct work_struct *work) container_of(work, struct delayed_work, work); struct bat_priv *bat_priv = container_of(delayed_work, struct bat_priv, vis_work); - struct vis_info *info, *temp; + struct vis_info *info; spin_lock_bh(&bat_priv->vis_hash_lock); purge_vis_packets(bat_priv); @@ -826,8 +826,9 @@ static void send_vis_packets(struct work_struct *work) send_list_add(bat_priv, bat_priv->my_vis_info); } - list_for_each_entry_safe(info, temp, &bat_priv->vis_send_list, - send_list) { + while (!list_empty(&bat_priv->vis_send_list)) { + info = list_first_entry(&bat_priv->vis_send_list, + typeof(*info), send_list); kref_get(&info->refcount); spin_unlock_bh(&bat_priv->vis_hash_lock); -- cgit v1.2.3