7 files changed, 57 insertions, 8 deletions

diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index 8e15d966d9b0..239992021b1d 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -837,6 +837,19 @@ bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv,
 
         dat_entry = batadv_dat_entry_hash_find(bat_priv, ip_dst);
         if (dat_entry) {
+                /* If the ARP request is destined for a local client the local
+                 * client will answer itself. DAT would only generate a
+                 * duplicate packet.
+                 *
+                 * Moreover, if the soft-interface is enslaved into a bridge, an
+                 * additional DAT answer may trigger kernel warnings about
+                 * a packet coming from the wrong port.
+                 */
+                if (batadv_is_my_client(bat_priv, dat_entry->mac_addr)) {
+                        ret = true;
+                        goto out;
+                }
+
                 skb_new = arp_create(ARPOP_REPLY, ETH_P_ARP, ip_src,
                                      bat_priv->soft_iface, ip_dst, hw_src,
                                      dat_entry->mac_addr, hw_src);
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index 3e30a0f1b908..51aafd669cbb 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -163,16 +163,25 @@ void batadv_mesh_free(struct net_device *soft_iface)
         batadv_vis_quit(bat_priv);
 
         batadv_gw_node_purge(bat_priv);
-        batadv_originator_free(bat_priv);
         batadv_nc_free(bat_priv);
+        batadv_dat_free(bat_priv);
+        batadv_bla_free(bat_priv);
 
+        /* Free the TT and the originator tables only after having terminated
+         * all the other depending components which may use these structures for
+         * their purposes.
+         */
         batadv_tt_free(bat_priv);
 
-        batadv_bla_free(bat_priv);
-
-        batadv_dat_free(bat_priv);
+        /* Since the originator table clean up routine is accessing the TT
+         * tables as well, it has to be invoked after the TT tables have been
+         * freed and marked as empty. This ensures that no cleanup RCU callbacks
+         * accessing the TT data are scheduled for later execution.
+         */
+        batadv_originator_free(bat_priv);
 
         free_percpu(bat_priv->bat_counters);
+        bat_priv->bat_counters = NULL;
 
         atomic_set(&bat_priv->mesh_state, BATADV_MESH_INACTIVE);
 }
@@ -475,7 +484,7 @@ static int batadv_param_set_ra(const char *val, const struct kernel_param *kp)
         char *algo_name = (char *)val;
         size_t name_len = strlen(algo_name);
 
-        if (algo_name[name_len - 1] == '\n')
+        if (name_len > 0 && algo_name[name_len - 1] == '\n')
                 algo_name[name_len - 1] = '\0';
 
         bat_algo_ops = batadv_algo_get(algo_name);
diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
index f7c54305a918..e84629ece9b7 100644
--- a/net/batman-adv/network-coding.c
+++ b/net/batman-adv/network-coding.c
@@ -1514,6 +1514,7 @@ batadv_nc_skb_decode_packet(struct batadv_priv *bat_priv, struct sk_buff *skb,
         struct ethhdr *ethhdr, ethhdr_tmp;
         uint8_t *orig_dest, ttl, ttvn;
         unsigned int coding_len;
+        int err;
 
         /* Save headers temporarily */
         memcpy(&coded_packet_tmp, skb->data, sizeof(coded_packet_tmp));
@@ -1568,8 +1569,11 @@ batadv_nc_skb_decode_packet(struct batadv_priv *bat_priv, struct sk_buff *skb,
                          coding_len);
 
         /* Resize decoded skb if decoded with larger packet */
-        if (nc_packet->skb->len > coding_len + h_size)
-                pskb_trim_rcsum(skb, coding_len + h_size);
+        if (nc_packet->skb->len > coding_len + h_size) {
+                err = pskb_trim_rcsum(skb, coding_len + h_size);
+                if (err)
+                        return NULL;
+        }
 
         /* Create decoded unicast packet */
         unicast_packet = (struct batadv_unicast_packet *)skb->data;
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 2f3452546636..fad1a2093e15 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -156,12 +156,28 @@ static void batadv_orig_node_free_rcu(struct rcu_head *rcu)
         kfree(orig_node);
 }
 
+/**
+ * batadv_orig_node_free_ref - decrement the orig node refcounter and possibly
+ * schedule an rcu callback for freeing it
+ * @orig_node: the orig node to free
+ */
 void batadv_orig_node_free_ref(struct batadv_orig_node *orig_node)
 {
         if (atomic_dec_and_test(&orig_node->refcount))
                 call_rcu(&orig_node->rcu, batadv_orig_node_free_rcu);
 }
 
+/**
+ * batadv_orig_node_free_ref_now - decrement the orig node refcounter and
+ * possibly free it (without rcu callback)
+ * @orig_node: the orig node to free
+ */
+void batadv_orig_node_free_ref_now(struct batadv_orig_node *orig_node)
+{
+        if (atomic_dec_and_test(&orig_node->refcount))
+                batadv_orig_node_free_rcu(&orig_node->rcu);
+}
+
 void batadv_originator_free(struct batadv_priv *bat_priv)
 {
         struct batadv_hashtable *hash = bat_priv->orig_hash;
diff --git a/net/batman-adv/originator.h b/net/batman-adv/originator.h
index 7df48fa7669d..734e5a3d8a5b 100644
--- a/net/batman-adv/originator.h
+++ b/net/batman-adv/originator.h
@@ -26,6 +26,7 @@ int batadv_originator_init(struct batadv_priv *bat_priv);
 void batadv_originator_free(struct batadv_priv *bat_priv);
 void batadv_purge_orig_ref(struct batadv_priv *bat_priv);
 void batadv_orig_node_free_ref(struct batadv_orig_node *orig_node);
+void batadv_orig_node_free_ref_now(struct batadv_orig_node *orig_node);
 struct batadv_orig_node *batadv_get_orig_node(struct batadv_priv *bat_priv,
                                               const uint8_t *addr);
 struct batadv_neigh_node *
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 6f20d339e33a..819dfb006cdf 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -505,6 +505,7 @@ unreg_debugfs:
         batadv_debugfs_del_meshif(dev);
 free_bat_counters:
         free_percpu(bat_priv->bat_counters);
+        bat_priv->bat_counters = NULL;
 
         return ret;
 }
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 5e89deeb9542..9e8748575845 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -144,7 +144,12 @@ static void batadv_tt_orig_list_entry_free_rcu(struct rcu_head *rcu)
         struct batadv_tt_orig_list_entry *orig_entry;
 
         orig_entry = container_of(rcu, struct batadv_tt_orig_list_entry, rcu);
-        batadv_orig_node_free_ref(orig_entry->orig_node);
+
+        /* We are in an rcu callback here, therefore we cannot use
+         * batadv_orig_node_free_ref() and its call_rcu():
+         * An rcu_barrier() wouldn't wait for that to finish
+         */
+        batadv_orig_node_free_ref_now(orig_entry->orig_node);
         kfree(orig_entry);
 }