tipc: involve reference counter for node structure

TIPC node hash node table is protected with rcu lock on read side.
tipc_node_find() is used to look for a node object with node address
through iterating the hash node table. As the entire process of what
tipc_node_find() traverses the table is guarded with rcu read lock,
it's safe for us. However, when callers use the node object returned
by tipc_node_find(), there is no rcu read lock applied. Therefore,
this is absolutely unsafe for callers of tipc_node_find().

Now we introduce a reference counter for node structure. Before
tipc_node_find() returns node object to its caller, it first increases
the reference counter. Accordingly, after its caller used it up,
it decreases the counter again. This can prevent a node being used by
one thread from being freed by another thread.

Reviewed-by: Erik Hugne <erik.hugne@ericsson.com>
Reviewed-by: Jon Maloy <jon.maloy@ericson.com>
Signed-off-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 3 insertions, 2 deletions

diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
index 4289dd62f589..ae558dd7f8ee 100644
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -329,13 +329,12 @@ static void bclink_peek_nack(struct net *net, struct tipc_msg *msg)
                 return;
 
         tipc_node_lock(n_ptr);
-
         if (n_ptr->bclink.recv_permitted &&
             (n_ptr->bclink.last_in != n_ptr->bclink.last_sent) &&
             (n_ptr->bclink.last_in == msg_bcgap_after(msg)))
                 n_ptr->bclink.oos_state = 2;
-
         tipc_node_unlock(n_ptr);
+        tipc_node_put(n_ptr);
 }
 
 /* tipc_bclink_xmit - deliver buffer chain to all nodes in cluster
@@ -466,6 +465,7 @@ void tipc_bclink_rcv(struct net *net, struct sk_buff *buf)
                         tipc_node_unlock(node);
                         bclink_peek_nack(net, msg);
                 }
+                tipc_node_put(node);
                 goto exit;
         }
 
@@ -570,6 +570,7 @@ receive:
 
 unlock:
         tipc_node_unlock(node);
+        tipc_node_put(node);
 exit:
         kfree_skb(buf);
 }