batman-adv: Make orig_node->router an rcu protected pointer

The rcu protected macros rcu_dereference() and rcu_assign_pointer()
for the orig_node->router need to be used, as well as spin/rcu locking.
Otherwise we might end up using a router pointer pointing to already
freed memory.

Therefore this commit introduces the safe getter method
orig_node_get_router().

Signed-off-by: Linus Lüssing <linus.luessing@web.de>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
Signed-off-by: Sven Eckelmann <sven@narfation.org>

1 files changed, 12 insertions, 7 deletions

diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index d49e54d932af..e78670c3c4b7 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -308,6 +308,7 @@ void schedule_forward_packet(struct orig_node *orig_node,
                              struct hard_iface *if_incoming)
 {
         struct bat_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
+        struct neigh_node *router;
         unsigned char in_tq, in_ttl, tq_avg = 0;
         unsigned long send_time;
 
@@ -316,6 +317,8 @@ void schedule_forward_packet(struct orig_node *orig_node,
                 return;
         }
 
+        router = orig_node_get_router(orig_node);
+
         in_tq = batman_packet->tq;
         in_ttl = batman_packet->ttl;
 
@@ -324,20 +327,22 @@ void schedule_forward_packet(struct orig_node *orig_node,
 
         /* rebroadcast tq of our best ranking neighbor to ensure the rebroadcast
          * of our best tq value */
-        if ((orig_node->router) && (orig_node->router->tq_avg != 0)) {
+        if (router && router->tq_avg != 0) {
 
                 /* rebroadcast ogm of best ranking neighbor as is */
-                if (!compare_eth(orig_node->router->addr, ethhdr->h_source)) {
-                        batman_packet->tq = orig_node->router->tq_avg;
+                if (!compare_eth(router->addr, ethhdr->h_source)) {
+                        batman_packet->tq = router->tq_avg;
 
-                        if (orig_node->router->last_ttl)
-                                batman_packet->ttl = orig_node->router->last_ttl
-                                                        - 1;
+                        if (router->last_ttl)
+                                batman_packet->ttl = router->last_ttl - 1;
                 }
 
-                tq_avg = orig_node->router->tq_avg;
+                tq_avg = router->tq_avg;
         }
 
+        if (router)
+                neigh_node_free_ref(router);
+
         /* apply hop penalty */
         batman_packet->tq = hop_penalty(batman_packet->tq, bat_priv);