[B.A.T.M.A.N.] [PATCH v4 02/31] batman-adv: Fix list removal of batadv_hardif_neigh_node

[Sven Eckelmann]

The neigh_list with batadv_hardif_neigh_node objects is accessed with only
rcu_read_lock in batadv_hardif_neigh_get and batadv_iv_neigh_print. Thus it
is not allowed to kfree the object before the rcu grace period ends (which
may still protects context accessing this object). Therefore the object has
first to be removed from the neigh_list and then it has either wait with
synchronize_rcu or call_rcu till the grace period ends before it can be
freed.

Fixes: fed2826b490c ("batman-adv: add list of unique single hop neighbors per 
hard-interface")
Signed-off-by: Sven Eckelmann <s...@narfation.org>
---
v4:
 - fix function names in commit messages
 - fix double whitespace in batadv_tt_orig_list_entry_release kerneldoc
 - add extra patch for batadv_claim_free_ref kerneldoc fix
 - change the phrase "free it" in all *_free_ref/*_put functions to "release it"
v3:
 - update copyright year
v2:
 - split patchset into fixes and kref migration to make it easier when the
   decision is made where each patch will be applied

 net/batman-adv/originator.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 00b0437..2681c7d 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -217,10 +217,6 @@ static void batadv_hardif_neigh_free_rcu(struct rcu_head 
*rcu)
 
        hardif_neigh = container_of(rcu, struct batadv_hardif_neigh_node, rcu);
 
-       spin_lock_bh(&hardif_neigh->if_incoming->neigh_list_lock);
-       hlist_del_init_rcu(&hardif_neigh->list);
-       spin_unlock_bh(&hardif_neigh->if_incoming->neigh_list_lock);
-
        batadv_hardif_free_ref_now(hardif_neigh->if_incoming);
        kfree(hardif_neigh);
 }
@@ -233,8 +229,13 @@ static void batadv_hardif_neigh_free_rcu(struct rcu_head 
*rcu)
 static void
 batadv_hardif_neigh_free_now(struct batadv_hardif_neigh_node *hardif_neigh)
 {
-       if (atomic_dec_and_test(&hardif_neigh->refcount))
+       if (atomic_dec_and_test(&hardif_neigh->refcount)) {
+               spin_lock_bh(&hardif_neigh->if_incoming->neigh_list_lock);
+               hlist_del_init_rcu(&hardif_neigh->list);
+               spin_unlock_bh(&hardif_neigh->if_incoming->neigh_list_lock);
+
                batadv_hardif_neigh_free_rcu(&hardif_neigh->rcu);
+       }
 }
 
 /**
@@ -244,8 +245,13 @@ batadv_hardif_neigh_free_now(struct 
batadv_hardif_neigh_node *hardif_neigh)
  */
 void batadv_hardif_neigh_free_ref(struct batadv_hardif_neigh_node 
*hardif_neigh)
 {
-       if (atomic_dec_and_test(&hardif_neigh->refcount))
+       if (atomic_dec_and_test(&hardif_neigh->refcount)) {
+               spin_lock_bh(&hardif_neigh->if_incoming->neigh_list_lock);
+               hlist_del_init_rcu(&hardif_neigh->list);
+               spin_unlock_bh(&hardif_neigh->if_incoming->neigh_list_lock);
+
                call_rcu(&hardif_neigh->rcu, batadv_hardif_neigh_free_rcu);
+       }
 }
 
 /**
-- 
2.6.4