UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

batman-adv: Avoid free/alloc race when handling OGM2 buffer 

A B.A.T.M.A.N. V virtual interface has an OGM2 packet buffer which is
initialized using data from the netdevice notifier and other rtnetlink
related hooks. It is sent regularly via various slave interfaces of the
batadv virtual interface and in this process also modified (realloced) to
integrate additional state information via TVLV containers.

It must be avoided that the worker item is executed without a common lock
with the netdevice notifier/rtnetlink helpers. Otherwise it can either
happen that half modified data is sent out or the functions modifying the
OGM2 buffer try to access already freed memory regions.

Fixes: 0da0035942 ("batman-adv: OGMv2 - add basic infrastructure")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
This commit is contained in:
Sven Eckelmann 2019-10-03 17:02:01 +02:00 committed by Simon Wunderlich
parent 54ecb8f702
commit a8d23cbbf6
2 changed files with 37 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
net/batman-adv/bat_v_ogm.c
View File

@ -18,6 +18,7 @@
#include <linux/kref.h> #include <linux/kref.h>
#include <linux/list.h> #include <linux/list.h>
#include <linux/lockdep.h> #include <linux/lockdep.h>
#include <linux/mutex.h>
#include <linux/netdevice.h> #include <linux/netdevice.h>
#include <linux/random.h> #include <linux/random.h>
#include <linux/rculist.h> #include <linux/rculist.h>
@ -256,14 +257,12 @@ static void batadv_v_ogm_queue_on_if(struct sk_buff *skb,
} }
/** /**
* batadv_v_ogm_send() - periodic worker broadcasting the own OGM * batadv_v_ogm_send_softif() - periodic worker broadcasting the own OGM
* @work: work queue item * @bat_priv: the bat priv with all the soft interface information
*/ */
static void batadv_v_ogm_send(struct work_struct *work) static void batadv_v_ogm_send_softif(struct batadv_priv *bat_priv)
{ {
struct batadv_hard_iface *hard_iface; struct batadv_hard_iface *hard_iface;
struct batadv_priv_bat_v *bat_v;
struct batadv_priv *bat_priv;
struct batadv_ogm2_packet *ogm_packet; struct batadv_ogm2_packet *ogm_packet;
struct sk_buff *skb, *skb_tmp; struct sk_buff *skb, *skb_tmp;
unsigned char *ogm_buff; unsigned char *ogm_buff;
@ -271,8 +270,7 @@ static void batadv_v_ogm_send(struct work_struct *work)
u16 tvlv_len = 0; u16 tvlv_len = 0;
int ret; int ret;
bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work); lockdep_assert_held(&bat_priv->bat_v.ogm_buff_mutex);
bat_priv = container_of(bat_v, struct batadv_priv, bat_v);
if (atomic_read(&bat_priv->mesh_state) == BATADV_MESH_DEACTIVATING) if (atomic_read(&bat_priv->mesh_state) == BATADV_MESH_DEACTIVATING)
goto out; goto out;
@ -363,6 +361,23 @@ out:
return; return;
} }
/**
* batadv_v_ogm_send() - periodic worker broadcasting the own OGM
* @work: work queue item
*/
static void batadv_v_ogm_send(struct work_struct *work)
{
struct batadv_priv_bat_v *bat_v;
struct batadv_priv *bat_priv;
bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work);
bat_priv = container_of(bat_v, struct batadv_priv, bat_v);
mutex_lock(&bat_priv->bat_v.ogm_buff_mutex);
batadv_v_ogm_send_softif(bat_priv);
mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex);
}
/** /**
* batadv_v_ogm_aggr_work() - OGM queue periodic task per interface * batadv_v_ogm_aggr_work() - OGM queue periodic task per interface
* @work: work queue item * @work: work queue item
@ -424,11 +439,15 @@ void batadv_v_ogm_primary_iface_set(struct batadv_hard_iface *primary_iface)
struct batadv_priv *bat_priv = netdev_priv(primary_iface->soft_iface); struct batadv_priv *bat_priv = netdev_priv(primary_iface->soft_iface);
struct batadv_ogm2_packet *ogm_packet; struct batadv_ogm2_packet *ogm_packet;
mutex_lock(&bat_priv->bat_v.ogm_buff_mutex);
if (!bat_priv->bat_v.ogm_buff) if (!bat_priv->bat_v.ogm_buff)
return; goto unlock;
ogm_packet = (struct batadv_ogm2_packet *)bat_priv->bat_v.ogm_buff; ogm_packet = (struct batadv_ogm2_packet *)bat_priv->bat_v.ogm_buff;
ether_addr_copy(ogm_packet->orig, primary_iface->net_dev->dev_addr); ether_addr_copy(ogm_packet->orig, primary_iface->net_dev->dev_addr);
unlock:
mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex);
} }
/** /**
@ -1050,6 +1069,8 @@ int batadv_v_ogm_init(struct batadv_priv *bat_priv)
atomic_set(&bat_priv->bat_v.ogm_seqno, random_seqno); atomic_set(&bat_priv->bat_v.ogm_seqno, random_seqno);
INIT_DELAYED_WORK(&bat_priv->bat_v.ogm_wq, batadv_v_ogm_send); INIT_DELAYED_WORK(&bat_priv->bat_v.ogm_wq, batadv_v_ogm_send);
mutex_init(&bat_priv->bat_v.ogm_buff_mutex);
return 0; return 0;
} }
@ -1061,7 +1082,11 @@ void batadv_v_ogm_free(struct batadv_priv *bat_priv)
{ {
cancel_delayed_work_sync(&bat_priv->bat_v.ogm_wq); cancel_delayed_work_sync(&bat_priv->bat_v.ogm_wq);
mutex_lock(&bat_priv->bat_v.ogm_buff_mutex);
kfree(bat_priv->bat_v.ogm_buff); kfree(bat_priv->bat_v.ogm_buff);
bat_priv->bat_v.ogm_buff = NULL; bat_priv->bat_v.ogm_buff = NULL;
bat_priv->bat_v.ogm_buff_len = 0; bat_priv->bat_v.ogm_buff_len = 0;
mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex);
} }

4
net/batman-adv/types.h
View File

@ -17,6 +17,7 @@
#include <linux/if.h> #include <linux/if.h>
#include <linux/if_ether.h> #include <linux/if_ether.h>
#include <linux/kref.h> #include <linux/kref.h>
#include <linux/mutex.h>
#include <linux/netdevice.h> #include <linux/netdevice.h>
#include <linux/netlink.h> #include <linux/netlink.h>
#include <linux/sched.h> /* for linux/wait.h */ #include <linux/sched.h> /* for linux/wait.h */
@ -1539,6 +1540,9 @@ struct batadv_priv_bat_v {
/** @ogm_seqno: OGM sequence number - used to identify each OGM */ /** @ogm_seqno: OGM sequence number - used to identify each OGM */
atomic_t ogm_seqno; atomic_t ogm_seqno;
/** @ogm_buff_mutex: lock protecting ogm_buff and ogm_buff_len */
struct mutex ogm_buff_mutex;
/** @ogm_wq: workqueue used to schedule OGM transmissions */ /** @ogm_wq: workqueue used to schedule OGM transmissions */
struct delayed_work ogm_wq; struct delayed_work ogm_wq;
}; };