Patch "batman-adv: Reduce refcnt of removed router when updating route" has been added to the 4.5-stable tree

This is a note to let you know that I've just added the patch titled

batman-adv: Reduce refcnt of removed router when updating route

to the 4.5-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
batman-adv-reduce-refcnt-of-removed-router-when-updating-route.patch
and it can be found in the queue-4.5 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Sven Eckelmann <[email protected]>
Date: Sun, 20 Mar 2016 12:27:53 +0100
Subject: batman-adv: Reduce refcnt of removed router when updating route

From: Sven Eckelmann <[email protected]>

commit d1a65f1741bfd9c69f9e4e2ad447a89b6810427d upstream.

_batadv_update_route rcu_derefences orig_ifinfo->router outside of a spinlock protected region to print some information messages to the debug log. But this pointer is not checked again when the new pointer is assigned in the spinlock protected region. Thus is can happen that the value of orig_ifinfo->router changed in the meantime and thus the reference counter of the wrong router gets reduced after the spinlock protected region.

Just rcu_dereferencing the value of orig_ifinfo->router inside the spinlock protected region (which also set the new pointer) is enough to get the correct old router object.

---
 net/batman-adv/routing.c |    9 +++++++++
 1 file changed, 9 insertions(+)

@@ -104,6 +104,15 @@ static void _batadv_update_route(struct
 		neigh_node = NULL;
 
 	spin_lock_bh(&orig_node->neigh_list_lock);
+	/* curr_router used earlier may not be the current orig_ifinfo->router
+	 * anymore because it was dereferenced outside of the neigh_list_lock
+	 * protected region. After the new best neighbor has replace the current
+	 * best neighbor the reference counter needs to decrease. Consequently,
+	 * the code needs to ensure the curr_router variable contains a pointer
+	 * to the replaced best neighbor.
+	 */
+	curr_router = rcu_dereference_protected(orig_ifinfo->router, true);
+
 	rcu_assign_pointer(orig_ifinfo->router, neigh_node);
 	spin_unlock_bh(&orig_node->neigh_list_lock);
 	batadv_orig_ifinfo_free_ref(orig_ifinfo);

Patches currently in stable-queue which might be from [email protected] are

queue-4.5/batman-adv-reduce-refcnt-of-removed-router-when-updating-route.patch queue-4.5/batman-adv-check-skb-size-before-using-encapsulated-eth-vlan-header.patch queue-4.5/batman-adv-fix-broadcast-ogm-queue-limit-on-a-removed-interface.patch queue-4.5/batman-adv-fix-dat-candidate-selection-must-use-vid.patch