batman-adv: protect bonding with rcu locks

bonding / alternating candidates need to be secured by rcu locks
as well. This patch therefore converts the bonding list
from a plain pointer list to a rcu securable lists and references
the bonding candidates.

Signed-off-by: Simon Wunderlich <siwu@hrz.tu-chemnitz.de>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

1 files changed, 163 insertions, 150 deletions

diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 7627ebe50c4b..1ad14da20839 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -271,6 +271,101 @@ out:
         return ret;
 }
 
+/* caller must hold the neigh_list_lock */
+void bonding_candidate_del(struct orig_node *orig_node,
+                           struct neigh_node *neigh_node)
+{
+        /* this neighbor is not part of our candidate list */
+        if (list_empty(&neigh_node->bonding_list))
+                goto out;
+
+        list_del_rcu(&neigh_node->bonding_list);
+        call_rcu(&neigh_node->rcu_bond, neigh_node_free_rcu_bond);
+        INIT_LIST_HEAD(&neigh_node->bonding_list);
+        atomic_dec(&orig_node->bond_candidates);
+
+out:
+        return;
+}
+
+static void bonding_candidate_add(struct orig_node *orig_node,
+                                  struct neigh_node *neigh_node)
+{
+        struct hlist_node *node;
+        struct neigh_node *tmp_neigh_node;
+        uint8_t best_tq, interference_candidate = 0;
+
+        spin_lock_bh(&orig_node->neigh_list_lock);
+
+        /* only consider if it has the same primary address ...  */
+        if (!compare_orig(orig_node->orig,
+                          neigh_node->orig_node->primary_addr))
+                goto candidate_del;
+
+        if (!orig_node->router)
+                goto candidate_del;
+
+        best_tq = orig_node->router->tq_avg;
+
+        /* ... and is good enough to be considered */
+        if (neigh_node->tq_avg < best_tq - BONDING_TQ_THRESHOLD)
+                goto candidate_del;
+
+        /**
+         * check if we have another candidate with the same mac address or
+         * interface. If we do, we won't select this candidate because of
+         * possible interference.
+         */
+        hlist_for_each_entry_rcu(tmp_neigh_node, node,
+                                 &orig_node->neigh_list, list) {
+
+                if (tmp_neigh_node == neigh_node)
+                        continue;
+
+                /* we only care if the other candidate is even
+                * considered as candidate. */
+                if (list_empty(&tmp_neigh_node->bonding_list))
+                        continue;
+
+                if ((neigh_node->if_incoming == tmp_neigh_node->if_incoming) ||
+                    (compare_orig(neigh_node->addr, tmp_neigh_node->addr))) {
+                        interference_candidate = 1;
+                        break;
+                }
+        }
+
+        /* don't care further if it is an interference candidate */
+        if (interference_candidate)
+                goto candidate_del;
+
+        /* this neighbor already is part of our candidate list */
+        if (!list_empty(&neigh_node->bonding_list))
+                goto out;
+
+        list_add_rcu(&neigh_node->bonding_list, &orig_node->bond_list);
+        kref_get(&neigh_node->refcount);
+        atomic_inc(&orig_node->bond_candidates);
+        goto out;
+
+candidate_del:
+        bonding_candidate_del(orig_node, neigh_node);
+
+out:
+        spin_unlock_bh(&orig_node->neigh_list_lock);
+        return;
+}
+
+/* copy primary address for bonding */
+static void bonding_save_primary(struct orig_node *orig_node,
+                                 struct orig_node *orig_neigh_node,
+                                 struct batman_packet *batman_packet)
+{
+        if (!(batman_packet->flags & PRIMARIES_FIRST_HOP))
+                return;
+
+        memcpy(orig_neigh_node->primary_addr, orig_node->orig, ETH_ALEN);
+}
+
 static void update_orig(struct bat_priv *bat_priv,
                         struct orig_node *orig_node,
                         struct ethhdr *ethhdr,
@@ -339,6 +434,8 @@ static void update_orig(struct bat_priv *bat_priv,
                 neigh_node->last_ttl = batman_packet->ttl;
         }
 
+        bonding_candidate_add(orig_node, neigh_node);
+
         tmp_hna_buff_len = (hna_buff_len > batman_packet->num_hna * ETH_ALEN ?
                             batman_packet->num_hna * ETH_ALEN : hna_buff_len);
 
@@ -497,123 +594,10 @@ err:
         return -1;
 }
 
-/* copy primary address for bonding */
-static void mark_bonding_address(struct orig_node *orig_node,
-                                 struct orig_node *orig_neigh_node,
-                                 struct batman_packet *batman_packet)
-
-{
-        if (batman_packet->flags & PRIMARIES_FIRST_HOP)
-                memcpy(orig_neigh_node->primary_addr,
-                       orig_node->orig, ETH_ALEN);
-
-        return;
-}
-
-/* mark possible bond.candidates in the neighbor list */
-void update_bonding_candidates(struct orig_node *orig_node)
-{
-        int candidates;
-        int interference_candidate;
-        int best_tq;
-        struct hlist_node *node, *node2;
-        struct neigh_node *tmp_neigh_node, *tmp_neigh_node2;
-        struct neigh_node *first_candidate, *last_candidate;
-
-        /* update the candidates for this originator */
-        if (!orig_node->router) {
-                orig_node->bond.candidates = 0;
-                return;
-        }
-
-        best_tq = orig_node->router->tq_avg;
-
-        /* update bond.candidates */
-
-        candidates = 0;
-
-        /* mark other nodes which also received "PRIMARIES FIRST HOP" packets
-         * as "bonding partner" */
-
-        /* first, zero the list */
-        rcu_read_lock();
-        hlist_for_each_entry_rcu(tmp_neigh_node, node,
-                                 &orig_node->neigh_list, list) {
-                tmp_neigh_node->next_bond_candidate = NULL;
-        }
-        rcu_read_unlock();
-
-        first_candidate = NULL;
-        last_candidate = NULL;
-
-        rcu_read_lock();
-        hlist_for_each_entry_rcu(tmp_neigh_node, node,
-                                 &orig_node->neigh_list, list) {
-
-                /* only consider if it has the same primary address ...  */
-                if (memcmp(orig_node->orig,
-                                tmp_neigh_node->orig_node->primary_addr,
-                                ETH_ALEN) != 0)
-                        continue;
-
-                /* ... and is good enough to be considered */
-                if (tmp_neigh_node->tq_avg < best_tq - BONDING_TQ_THRESHOLD)
-                        continue;
-
-                /* check if we have another candidate with the same
-                 * mac address or interface. If we do, we won't
-                 * select this candidate because of possible interference. */
-
-                interference_candidate = 0;
-                hlist_for_each_entry_rcu(tmp_neigh_node2, node2,
-                                         &orig_node->neigh_list, list) {
-
-                        if (tmp_neigh_node2 == tmp_neigh_node)
-                                continue;
-
-                        /* we only care if the other candidate is even
-                         * considered as candidate. */
-                        if (!tmp_neigh_node2->next_bond_candidate)
-                                continue;
-
-
-                        if ((tmp_neigh_node->if_incoming ==
-                                tmp_neigh_node2->if_incoming)
-                                || (memcmp(tmp_neigh_node->addr,
-                                tmp_neigh_node2->addr, ETH_ALEN) == 0)) {
-
-                                interference_candidate = 1;
-                                break;
-                        }
-                }
-                /* don't care further if it is an interference candidate */
-                if (interference_candidate)
-                        continue;
-
-                if (!first_candidate) {
-                        first_candidate = tmp_neigh_node;
-                        tmp_neigh_node->next_bond_candidate = first_candidate;
-                } else
-                        tmp_neigh_node->next_bond_candidate = last_candidate;
-
-                last_candidate = tmp_neigh_node;
-
-                candidates++;
-        }
-        rcu_read_unlock();
-
-        if (candidates > 0) {
-                first_candidate->next_bond_candidate = last_candidate;
-                orig_node->bond.selected = first_candidate;
-        }
-
-        orig_node->bond.candidates = candidates;
-}
-
 void receive_bat_packet(struct ethhdr *ethhdr,
-                                struct batman_packet *batman_packet,
-                                unsigned char *hna_buff, int hna_buff_len,
-                                struct batman_if *if_incoming)
+                        struct batman_packet *batman_packet,
+                        unsigned char *hna_buff, int hna_buff_len,
+                        struct batman_if *if_incoming)
 {
         struct bat_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
         struct batman_if *batman_if;
@@ -795,6 +779,8 @@ void receive_bat_packet(struct ethhdr *ethhdr,
         is_bidirectional = is_bidirectional_neigh(orig_node, orig_neigh_node,
                                                 batman_packet, if_incoming);
 
+        bonding_save_primary(orig_node, orig_neigh_node, batman_packet);
+
         /* update ranking if it is not a duplicate or has the same
          * seqno and similar ttl as the non-duplicate */
         if (is_bidirectional &&
@@ -804,9 +790,6 @@ void receive_bat_packet(struct ethhdr *ethhdr,
                 update_orig(bat_priv, orig_node, ethhdr, batman_packet,
                             if_incoming, hna_buff, hna_buff_len, is_duplicate);
 
-        mark_bonding_address(orig_node, orig_neigh_node, batman_packet);
-        update_bonding_candidates(orig_node);
-
         /* is single hop (direct) neighbor */
         if (is_single_hop_neigh) {
 
@@ -1095,14 +1078,15 @@ int recv_icmp_packet(struct sk_buff *skb, struct batman_if *recv_if)
 }
 
 /* find a suitable router for this originator, and use
- * bonding if possible. */
+ * bonding if possible. increases the found neighbors
+ * refcount.*/
 struct neigh_node *find_router(struct bat_priv *bat_priv,
                                struct orig_node *orig_node,
                                struct batman_if *recv_if)
 {
         struct orig_node *primary_orig_node;
         struct orig_node *router_orig;
-        struct neigh_node *router, *first_candidate, *best_router;
+        struct neigh_node *router, *first_candidate, *tmp_neigh_node;
         static uint8_t zero_mac[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
         int bonding_enabled;
 
@@ -1114,18 +1098,25 @@ struct neigh_node *find_router(struct bat_priv *bat_priv,
 
         /* without bonding, the first node should
          * always choose the default router. */
-
         bonding_enabled = atomic_read(&bat_priv->bonding);
 
-        if ((!recv_if) && (!bonding_enabled))
-                return orig_node->router;
-
+        rcu_read_lock();
+        /* select default router to output */
+        router = orig_node->router;
         router_orig = orig_node->router->orig_node;
+        if (!router_orig) {
+                rcu_read_unlock();
+                return NULL;
+        }
+
+
+        if ((!recv_if) && (!bonding_enabled))
+                goto return_router;
 
         /* if we have something in the primary_addr, we can search
          * for a potential bonding candidate. */
         if (memcmp(router_orig->primary_addr, zero_mac, ETH_ALEN) == 0)
-                return orig_node->router;
+                goto return_router;
 
         /* find the orig_node which has the primary interface. might
          * even be the same as our router_orig in many cases */
@@ -1134,60 +1125,81 @@ struct neigh_node *find_router(struct bat_priv *bat_priv,
                                 router_orig->orig, ETH_ALEN) == 0) {
                 primary_orig_node = router_orig;
         } else {
-                rcu_read_lock();
                 primary_orig_node = hash_find(bat_priv->orig_hash, compare_orig,
                                                choose_orig,
                                                router_orig->primary_addr);
-                rcu_read_unlock();
-
                 if (!primary_orig_node)
-                        return orig_node->router;
+                        goto return_router;
         }
 
         /* with less than 2 candidates, we can't do any
          * bonding and prefer the original router. */
-
-        if (primary_orig_node->bond.candidates < 2)
-                return orig_node->router;
+        if (atomic_read(&primary_orig_node->bond_candidates) < 2)
+                goto return_router;
 
 
         /* all nodes between should choose a candidate which
          * is is not on the interface where the packet came
          * in. */
-        first_candidate = primary_orig_node->bond.selected;
-        router = first_candidate;
+
+        first_candidate = NULL;
+        router = NULL;
 
         if (bonding_enabled) {
                 /* in the bonding case, send the packets in a round
                  * robin fashion over the remaining interfaces. */
-                do {
+
+                list_for_each_entry_rcu(tmp_neigh_node,
+                                &primary_orig_node->bond_list, bonding_list) {
+                        if (!first_candidate)
+                                first_candidate = tmp_neigh_node;
                         /* recv_if == NULL on the first node. */
-                        if (router->if_incoming != recv_if)
+                        if (tmp_neigh_node->if_incoming != recv_if) {
+                                router = tmp_neigh_node;
                                 break;
+                        }
+                }
 
-                        router = router->next_bond_candidate;
-                } while (router != first_candidate);
+                /* use the first candidate if nothing was found. */
+                if (!router)
+                        router = first_candidate;
 
-                primary_orig_node->bond.selected = router->next_bond_candidate;
+                /* selected should point to the next element
+                 * after the current router */
+                spin_lock_bh(&primary_orig_node->neigh_list_lock);
+                /* this is a list_move(), which unfortunately
+                 * does not exist as rcu version */
+                list_del_rcu(&primary_orig_node->bond_list);
+                list_add_rcu(&primary_orig_node->bond_list,
+                                &router->bonding_list);
+                spin_unlock_bh(&primary_orig_node->neigh_list_lock);
 
         } else {
                 /* if bonding is disabled, use the best of the
                  * remaining candidates which are not using
                  * this interface. */
-                best_router = first_candidate;
+                list_for_each_entry_rcu(tmp_neigh_node,
+                        &primary_orig_node->bond_list, bonding_list) {
+                        if (!first_candidate)
+                                first_candidate = tmp_neigh_node;
 
-                do {
                         /* recv_if == NULL on the first node. */
-                        if ((router->if_incoming != recv_if) &&
-                                (router->tq_avg > best_router->tq_avg))
-                                        best_router = router;
-
-                        router = router->next_bond_candidate;
-                } while (router != first_candidate);
+                        if (tmp_neigh_node->if_incoming != recv_if)
+                                /* if we don't have a router yet
+                                 * or this one is better, choose it. */
+                                if ((!router) ||
+                                (tmp_neigh_node->tq_avg > router->tq_avg)) {
+                                        router = tmp_neigh_node;
+                                }
+                }
 
-                router = best_router;
+                /* use the first candidate if nothing was found. */
+                if (!router)
+                        router = first_candidate;
         }
-
+return_router:
+        kref_get(&router->refcount);
+        rcu_read_unlock();
         return router;
 }
 
@@ -1247,6 +1259,7 @@ int route_unicast_packet(struct sk_buff *skb, struct batman_if *recv_if,
                                unicast_packet->dest));
         rcu_read_unlock();
 
+        /* find_router() increases neigh_nodes refcount if found. */
         router = find_router(bat_priv, orig_node, recv_if);
 
         if (!router) {