mac80211: mesh: fix call_rcu() usage
commit c2e703a55245bfff3db53b1f7cbe59f1ee8a4339 upstream.
When using call_rcu(), the called function may be delayed quite
significantly, and without a matching rcu_barrier() there's no
way to be sure it has finished.
Therefore, global state that could be gone/freed/reused should
never be touched in the callback.
Fix this in mesh by moving the atomic_dec() into the caller;
that's not really a problem since we already unlinked the path
and it will be destroyed anyway.
This fixes a crash Jouni observed when running certain tests in
a certain order, in which the mesh interface was torn down, the
memory reused for a function pointer (work struct) and running
that then crashed since the pointer had been decremented by 1,
resulting in an invalid instruction byte stream.
Fixes: eb2b9311fd
("mac80211: mesh path table implementation")
Reported-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
963e16256e
commit
1467bec9a7
|
@ -747,10 +747,8 @@ void mesh_plink_broken(struct sta_info *sta)
|
||||||
static void mesh_path_node_reclaim(struct rcu_head *rp)
|
static void mesh_path_node_reclaim(struct rcu_head *rp)
|
||||||
{
|
{
|
||||||
struct mpath_node *node = container_of(rp, struct mpath_node, rcu);
|
struct mpath_node *node = container_of(rp, struct mpath_node, rcu);
|
||||||
struct ieee80211_sub_if_data *sdata = node->mpath->sdata;
|
|
||||||
|
|
||||||
del_timer_sync(&node->mpath->timer);
|
del_timer_sync(&node->mpath->timer);
|
||||||
atomic_dec(&sdata->u.mesh.mpaths);
|
|
||||||
kfree(node->mpath);
|
kfree(node->mpath);
|
||||||
kfree(node);
|
kfree(node);
|
||||||
}
|
}
|
||||||
|
@ -758,8 +756,9 @@ static void mesh_path_node_reclaim(struct rcu_head *rp)
|
||||||
/* needs to be called with the corresponding hashwlock taken */
|
/* needs to be called with the corresponding hashwlock taken */
|
||||||
static void __mesh_path_del(struct mesh_table *tbl, struct mpath_node *node)
|
static void __mesh_path_del(struct mesh_table *tbl, struct mpath_node *node)
|
||||||
{
|
{
|
||||||
struct mesh_path *mpath;
|
struct mesh_path *mpath = node->mpath;
|
||||||
mpath = node->mpath;
|
struct ieee80211_sub_if_data *sdata = node->mpath->sdata;
|
||||||
|
|
||||||
spin_lock(&mpath->state_lock);
|
spin_lock(&mpath->state_lock);
|
||||||
mpath->flags |= MESH_PATH_RESOLVING;
|
mpath->flags |= MESH_PATH_RESOLVING;
|
||||||
if (mpath->is_gate)
|
if (mpath->is_gate)
|
||||||
|
@ -767,6 +766,7 @@ static void __mesh_path_del(struct mesh_table *tbl, struct mpath_node *node)
|
||||||
hlist_del_rcu(&node->list);
|
hlist_del_rcu(&node->list);
|
||||||
call_rcu(&node->rcu, mesh_path_node_reclaim);
|
call_rcu(&node->rcu, mesh_path_node_reclaim);
|
||||||
spin_unlock(&mpath->state_lock);
|
spin_unlock(&mpath->state_lock);
|
||||||
|
atomic_dec(&sdata->u.mesh.mpaths);
|
||||||
atomic_dec(&tbl->entries);
|
atomic_dec(&tbl->entries);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue