batman-adv: fix reference counting imbalance while sending fragment
PATCH 1/1 batman-adv: fix reference counting imbalance while sending fragment
From: Antonio Quartulli <[email protected]>
In the new fragmentation code the batadv_frag_send_packet() function obtains a reference to the primary_if, but it does not release it upon return.
This reference imbalance prevents the primary_if (and then the related netdevice) to be properly released on shut down.
Fix this by releasing the primary_if in batadv_frag_send_packet().
Introduced by db56e4ecf5c2b179a0101138eacc2ec52b6ef45d ("batman-adv: Fragment and send skbs larger than mtu")
--- fragmentation.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
fragmentation.c +8 -3
@@ -418,12 +418,13 @@ bool batadv_frag_send_packet(struct sk_buff *skb, struct batadv_neigh_node *neigh_node) {struct batadv_priv *bat_priv; -struct batadv_hard_iface *primary_if; +struct batadv_hard_iface *primary_if =NULL ;struct batadv_frag_packet frag_header;struct sk_buff *skb_fragment;unsigned mtu = neigh_node->if_incoming->net_dev->mtu;unsigned header_size =sizeof (frag_header);unsigned max_fragment_size, max_packet_size; +bool ret = false;/* To avoid merge and refragmentation at next-hops we never send * fragments larger than BATADV_FRAG_MAX_FRAG_SIZE
@@ -483,7 +484,11 @@ bool batadv_frag_send_packet(struct sk_buff *skb, skb->len + ETH_HLEN);batadv_send_skb_packet (skb, neigh_node->if_incoming, neigh_node->addr); -return true; + ret = true; + out_err: -return false; +if (primary_if) +batadv_hardif_free_ref (primary_if); + +return ret; }
Signature · 1 line
1.8.3.2
Hi Antonio,
Good catch!
Quoted 9 lines · Antonio Quartulli
From: Antonio Quartulli <[email protected]>
In the new fragmentation code the
batadv_frag_send_packet()function obtains a reference to theprimary_if, but it does not release it upon return.This reference imbalance prevents the
primary_if(and then the related netdevice) to be properly released on shut down.
Quoted 7 lines
Fix this by releasing the
primary_ifinbatadv_frag_send_packet().Introduced by
db56e4ecf5c2b179a0101138eacc2ec52b6ef45d("batman-adv: Fragment and send skbs larger than mtu")Cc Martin Hundebøll <[email protected]>Signed-off-by Antonio Quartulli <[email protected]>
// Martin
Quoted 38 lines
--- fragmentation.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)fragmentation.c +8
-3@@ -418,12 +418,13 @@ bool batadv_frag_send_packet(struct sk_buff *skb, struct batadv_neigh_node *neigh_node) {struct batadv_priv *bat_priv; -struct batadv_hard_iface *primary_if; +struct batadv_hard_iface *primary_if =NULL ;struct batadv_frag_packet frag_header;struct sk_buff *skb_fragment;unsigned mtu = neigh_node->if_incoming->net_dev->mtu;unsigned header_size =sizeof (frag_header);unsigned max_fragment_size, max_packet_size; +bool ret = false;/* To avoid merge and refragmentation at next-hops we never send * fragments larger than BATADV_FRAG_MAX_FRAG_SIZE @@ -483,7 +484,11 @@ bool batadv_frag_send_packet(struct sk_buff *skb, skb->len + ETH_HLEN);batadv_send_skb_packet (skb, neigh_node->if_incoming, neigh_node->addr); -return true; + ret = true; + out_err: -return false; +if (primary_if) +batadv_hardif_free_ref (primary_if); + +return ret;}
Marek Lindner
AppliedQuoted 12 lines · On Wednesday 23 April 2014 09:40:05 [email protected] wrote:
Quoted 11 lines · Antonio Quartulli
From: Antonio Quartulli <[email protected]>
In the new fragmentation code the
batadv_frag_send_packet()function obtains a reference to theprimary_if, but it does not release it upon return.This reference imbalance prevents the
primary_if(and then the related netdevice) to be properly released on shut down.Fix this by releasing the
primary_ifinbatadv_frag_send_packet().
Quoted 7 lines
Quoted 5 lines
Introduced by
db56e4ecf5c2b179a0101138eacc2ec52b6ef45d("batman-adv: Fragment and send skbs larger than mtu")Cc Martin Hundebøll <[email protected]>Signed-off-by Antonio Quartulli <[email protected]>Acked-by Martin Hundebøll <[email protected]>
Applied in revision 113f264.
Thanks,
Marek