pull request net: batman-adv 20140510

Hello David,

here you have 4 small but important patches from Simon Wunderlich intended for net/linux-3.15 and *stable/linux-3.14* (please enqueue them).

I know it's rather late in the rc cycle but these 4 changes are addressing some severe reference counting imbalances in different parts of code.

All these reference counting problems are rather important because they prevent the netdev object used by batman-adv from being released and then the system from properly shutdown/reboot/reconfigure by holding the networking stack with the following (sad) message:

unregister_netdevice: waiting for mesh0 to become free. Usage count = 1

Please pull or let me know of any problem!

Thanks a lot,
Antonio

The following changes since commit 1448eb566970c6d3cade522419848fdaee24c684:

Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless (2014-05-09 16:46:53 -0400)

are available in the git repository at:

git://git.open-mesh.org/linux-merge.git tags/batman-adv-fix-for-davem

for you to fetch changes up to 29bcc8064fc0b82bc708c09577d550923b954e5a:

batman-adv: fix removing neigh_ifinfo (2014-05-10 10:59:05 +0200)

----------------------------------------------------------------
Included changes:
- properly release neigh_ifinfo in batadv_iv_ogm_process_per_outif()
- properly release orig_ifinfo->router when freeing orig_ifinfo
- properly release neigh_node objects during periodic check
- properly release neigh_info objects when the related hard_iface is free'd

These changes are all very important because they fix some reference counting imbalances that lead to the impossibility of releasing the netdev object used by batman-adv on shutdown.
The consequence is that such object cannot be destroyed by the networking stack (the refcounter does not reach zero) thus bringing the system in hanging state during a normal reboot operation or a network reconfiguration.

----------------------------------------------------------------
Simon Wunderlich (4):
batman-adv: fix neigh_ifinfo imbalance
batman-adv: fix neigh reference imbalance
batman-adv: always run purge_orig_neighbors
batman-adv: fix removing neigh_ifinfo

 net/batman-adv/bat_iv_ogm.c |  2 ++
 net/batman-adv/originator.c | 59 ++++++++++++++++++++++++++++++++++++++++++---
 2 files changed, 57 insertions(+), 4 deletions(-)

From: Simon Wunderlich <[email protected]>

The neigh_ifinfo object must be freed if it has been used in batadv_iv_ogm_process_per_outif().

This is a regression introduced by 89652331c00f43574515059ecbf262d26d885717 ("batman-adv: split tq information in neigh_node struct")

---
 net/batman-adv/bat_iv_ogm.c | 2 ++
 1 file changed, 2 insertions(+)

index b3bd4ec..f04224c 100644
@@ -1545,6 +1545,8 @@ out_neigh:
 	if ((orig_neigh_node) && (!is_single_hop_neigh))
 		batadv_orig_node_free_ref(orig_neigh_node);
 out:
+	if (router_ifinfo)
+		batadv_neigh_ifinfo_free_ref(router_ifinfo);
 	if (router)
 		batadv_neigh_node_free_ref(router);
 	if (router_router)

1.8.5.5

From: Simon Wunderlich <[email protected]>

When an interface is removed from batman-adv, the orig_ifinfo of a orig_node may be removed without releasing the router first. This will prevent the reference for the neighbor pointed at by the orig_ifinfo->router to be released, and this leak may result in reference leaks for the interface used by this neighbor. Fix that.

This is a regression introduced by
7351a4822d42827ba0110677c0cbad88a3d52585
("batman-adv: split out router from orig_node").

---
 net/batman-adv/originator.c | 5 +++++
 1 file changed, 5 insertions(+)

index ffd9dfb..a43da69 100644
@@ -501,12 +501,17 @@ batadv_neigh_node_get(const struct batadv_orig_node *orig_node,
 static void batadv_orig_ifinfo_free_rcu(struct rcu_head *rcu)
 {
 	struct batadv_orig_ifinfo *orig_ifinfo;
+	struct batadv_neigh_node *router;
 
 	orig_ifinfo = container_of(rcu, struct batadv_orig_ifinfo, rcu);
 
 	if (orig_ifinfo->if_outgoing != BATADV_IF_DEFAULT)
 		batadv_hardif_free_ref_now(orig_ifinfo->if_outgoing);
 
+	/* this is the last reference to this object */
+	router = rcu_dereference_protected(orig_ifinfo->router, true);
+	if (router)
+		batadv_neigh_node_free_ref_now(router);
 	kfree(orig_ifinfo);
 }
 

1.8.5.5

From: Simon Wunderlich <[email protected]>

The current code will not execute batadv_purge_orig_neighbors() when an orig_ifinfo has already been purged. However we need to run it in any case. Fix that.

This is a regression introduced by
7351a4822d42827ba0110677c0cbad88a3d52585
("batman-adv: split out router from orig_node")

---
 net/batman-adv/originator.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

index a43da69..8104c3c 100644
@@ -862,7 +862,7 @@ static bool batadv_purge_orig_node(struct batadv_priv *bat_priv,
 {
 	struct batadv_neigh_node *best_neigh_node;
 	struct batadv_hard_iface *hard_iface;
-	bool changed;
+	bool changed_ifinfo, changed_neigh;
 
 	if (batadv_has_timed_out(orig_node->last_seen,
 				 2 * BATADV_PURGE_TIMEOUT)) {

@@ -872,10 +872,10 @@ static bool batadv_purge_orig_node(struct batadv_priv *bat_priv,
 			   jiffies_to_msecs(orig_node->last_seen));
 		return true;
 	}
-	changed = batadv_purge_orig_ifinfo(bat_priv, orig_node);
-	changed = changed || batadv_purge_orig_neighbors(bat_priv, orig_node);
+	changed_ifinfo = batadv_purge_orig_ifinfo(bat_priv, orig_node);
+	changed_neigh = batadv_purge_orig_neighbors(bat_priv, orig_node);
 
-	if (!changed)
+	if (!changed_ifinfo && !changed_neigh)
 		return false;
 
 	/* first for NULL ... */

1.8.5.5

From: Simon Wunderlich <[email protected]>

When an interface is removed separately, all neighbors need to be checked if they have a neigh_ifinfo structure for that particular interface. If that is the case, remove that ifinfo so any references to a hard interface can be freed.

This is a regression introduced by 89652331c00f43574515059ecbf262d26d885717 ("batman-adv: split tq information in neigh_node struct")

---
 net/batman-adv/originator.c | 46 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

index 8104c3c..427c07d 100644
@@ -707,6 +707,47 @@ free_orig_node:
 }
 
 /**
+ * batadv_purge_neigh_ifinfo - purge obsolete ifinfo entries from neighbor
+ * @bat_priv: the bat priv with all the soft interface information
+ * @neigh_node: orig node which is to be checked
+ */
+static void
+batadv_purge_neigh_ifinfo(struct batadv_priv *bat_priv,
+			  struct batadv_neigh_node *neigh)
+{
+	struct batadv_neigh_ifinfo *neigh_ifinfo;
+	struct batadv_hard_iface *if_outgoing;
+	struct hlist_node *node_tmp;
+
+	spin_lock_bh(&neigh->ifinfo_lock);
+
+	/* for all ifinfo objects for this neighinator */
+	hlist_for_each_entry_safe(neigh_ifinfo, node_tmp,
+				  &neigh->ifinfo_list, list) {
+		if_outgoing = neigh_ifinfo->if_outgoing;
+
+		/* always keep the default interface */
+		if (if_outgoing == BATADV_IF_DEFAULT)
+			continue;
+
+		/* don't purge if the interface is not (going) down */
+		if ((if_outgoing->if_status != BATADV_IF_INACTIVE) &&
+		    (if_outgoing->if_status != BATADV_IF_NOT_IN_USE) &&
+		    (if_outgoing->if_status != BATADV_IF_TO_BE_REMOVED))
+			continue;
+
+		batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
+			   "neighbor/ifinfo purge: neighbor %pM, iface: %s\n",
+			   neigh->addr, if_outgoing->net_dev->name);
+
+		hlist_del_rcu(&neigh_ifinfo->list);
+		batadv_neigh_ifinfo_free_ref(neigh_ifinfo);
+	}
+
+	spin_unlock_bh(&neigh->ifinfo_lock);
+}
+
+/**
  * batadv_purge_orig_ifinfo - purge obsolete ifinfo entries from originator
  * @bat_priv: the bat priv with all the soft interface information
  * @orig_node: orig node which is to be checked

@@ -805,6 +846,11 @@ batadv_purge_orig_neighbors(struct batadv_priv *bat_priv,
 
 			hlist_del_rcu(&neigh_node->list);
 			batadv_neigh_node_free_ref(neigh_node);
+		} else {
+			/* only neccesary if not the whole neighbor is to be deleted,
+			 * but some interface has been removed.
+			 */
+			batadv_purge_neigh_ifinfo(bat_priv, neigh_node);
 		}
 	}
 

1.8.5.5

Hello.

Good catch! Thanks Sergei

I will fix that and update the tag.

Cheers,

Antonio Quartulli

The tag points now to 05191f523653461ca6a4e4fb38012e0d8f3c5641 because I fixed a too long line.

Cheers,

Antonio Quartulli

David,

the batman-adv-fix-for-davem tag now points to 709de13f0c532fe9c468c094aff069a725ed57fe which contains the fix for the long line I said before, the fix for the kerneldoc as suggested by Sergei and a correction of a small typ0.

I can re-send the whole pull request if you want, but I wanted to avoid to create more noise, unless it is needed.

Thanks a lot.

Cheers,

Antonio Quartulli

From: Antonio Quartulli <[email protected]>
Date: Sat, 10 May 2014 17:35:06 +0200

Pulled and queued up for -stable, thanks.