[B.A.T.M.A.N.] [PATCH] batman-adv: Avoid double freeing of bat_counters

[B.A.T.M.A.N.] [PATCH] batman-adv: Avoid double freeing of bat_counters

[Martin Hundebøll]

On errors in batadv_mesh_init(), bat_counters will be freed in both
batadv_mesh_free() and batadv_softif_init_late(). This patch fixes this
by returning earlier from batadv_softif_init_late() in case of errors in
batadv_mesh_init().

Signed-off-by: Martin Hundebøll <martin@hundeboll.net>
---
 soft-interface.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/soft-interface.c b/soft-interface.c
index c2a9c20..4de4d0f 100644
--- a/soft-interface.c
+++ b/soft-interface.c
@@ -503,6 +503,9 @@ static int batadv_softif_init_late(struct net_device *dev)
 
 unreg_debugfs:
 	batadv_debugfs_del_meshif(dev);
+
+	return ret;
+
 free_bat_counters:
 	free_percpu(bat_priv->bat_counters);
 
-- 
1.8.2.1

Re: [B.A.T.M.A.N.] [PATCH] batman-adv: Avoid double freeing of bat_counters

[Antonio Quartulli]

[-- Attachment #1: Type: text/plain, Size: 1127 bytes --]

On Wed, Apr 17, 2013 at 12:28:50PM +0200, Martin Hundebøll wrote:
> On errors in batadv_mesh_init(), bat_counters will be freed in both
> batadv_mesh_free() and batadv_softif_init_late(). This patch fixes this
> by returning earlier from batadv_softif_init_late() in case of errors in
> batadv_mesh_init().
> 
> Signed-off-by: Martin Hundebøll <martin@hundeboll.net>
> ---
>  soft-interface.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/soft-interface.c b/soft-interface.c
> index c2a9c20..4de4d0f 100644
> --- a/soft-interface.c
> +++ b/soft-interface.c
> @@ -503,6 +503,9 @@ static int batadv_softif_init_late(struct net_device *dev)
>  
>  unreg_debugfs:
>  	batadv_debugfs_del_meshif(dev);
> +
> +	return ret;
> +

Hi Martin, good catch!
But using 1 goto to execute 1 operation is not very good.
What about this:


ret = batadv_mesh_init(dev);
if (ret < 0)
	batadv_debugfs_del_meshif(dev);

return ret;


and remove the unreg_debugfs label at all (and its content)


Cheers,

-- 
Antonio Quartulli

..each of us alone is worth nothing..
Ernesto "Che" Guevara

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]

[B.A.T.M.A.N.] [PATCHv2] batman-adv: Avoid double freeing of bat_counters

[Martin Hundebøll]

On errors in batadv_mesh_init(), bat_counters will be freed in both
batadv_mesh_free() and batadv_softif_init_late(). This patch fixes this
by returning earlier from batadv_softif_init_late() in case of errors in
batadv_mesh_init().

Signed-off-by: Martin Hundebøll <martin@hundeboll.net>
---
v2:
  Removed label as suggested by Antonio

 soft-interface.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/soft-interface.c b/soft-interface.c
index c2a9c20..44089b3 100644
--- a/soft-interface.c
+++ b/soft-interface.c
@@ -497,12 +497,10 @@ static int batadv_softif_init_late(struct net_device *dev)
 
 	ret = batadv_mesh_init(dev);
 	if (ret < 0)
-		goto unreg_debugfs;
+		batadv_debugfs_del_meshif(dev);
 
-	return 0;
+	return ret;
 
-unreg_debugfs:
-	batadv_debugfs_del_meshif(dev);
 free_bat_counters:
 	free_percpu(bat_priv->bat_counters);
 
-- 
1.8.2.1

Re: [B.A.T.M.A.N.] [PATCHv2] batman-adv: Avoid double freeing of bat_counters

[Marek Lindner]

On Wednesday, April 17, 2013 20:36:46 Martin Hundebøll wrote:
> --- a/soft-interface.c
> +++ b/soft-interface.c
> @@ -497,12 +497,10 @@ static int batadv_softif_init_late(struct net_device
> *dev) 
>         ret = batadv_mesh_init(dev);
>         if (ret < 0)
> -               goto unreg_debugfs;
> +               batadv_debugfs_del_meshif(dev);
>  
> -       return 0;
> +       return ret;
>  
> -unreg_debugfs:
> -       batadv_debugfs_del_meshif(dev);
>  free_bat_counters:
>         free_percpu(bat_priv->bat_counters);
>  

This looks like a valid problem but I do suggest setting bat_priv-
>bat_counters to NULL after calling free_percpu(). Otherwise we will run into 
this problem again when somebody else changes the order of the calls ...


Cheers,
Marek

[B.A.T.M.A.N.] [PATCHv3] batman-adv: Avoid double freeing of bat_counters

[Martin Hundebøll]

On errors in batadv_mesh_init(), bat_counters will be freed in both
batadv_mesh_free() and batadv_softif_init_late(). This patch fixes this
by returning earlier from batadv_softif_init_late() in case of errors in
batadv_mesh_init() and by setting bat_counters to NULL after freeing.

Signed-off-by: Martin Hundebøll <martin@hundeboll.net>
---
v2:
  Removed label as suggested by Antonio
v3:
  Set bat_counters to NULL after freeing

 main.c           | 1 +
 soft-interface.c | 9 ++++-----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/main.c b/main.c
index 3e30a0f..aae96ca 100644
--- a/main.c
+++ b/main.c
@@ -173,6 +173,7 @@ void batadv_mesh_free(struct net_device *soft_iface)
 	batadv_dat_free(bat_priv);
 
 	free_percpu(bat_priv->bat_counters);
+	bat_priv->bat_counters = NULL;
 
 	atomic_set(&bat_priv->mesh_state, BATADV_MESH_INACTIVE);
 }
diff --git a/soft-interface.c b/soft-interface.c
index c2a9c20..6946caa 100644
--- a/soft-interface.c
+++ b/soft-interface.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2013 B.A.T.M.A.N. contributors:
+#/* Copyright (C) 2007-2013 B.A.T.M.A.N. contributors:
  *
  * Marek Lindner, Simon Wunderlich
  *
@@ -497,14 +497,13 @@ static int batadv_softif_init_late(struct net_device *dev)
 
 	ret = batadv_mesh_init(dev);
 	if (ret < 0)
-		goto unreg_debugfs;
+		batadv_debugfs_del_meshif(dev);
 
-	return 0;
+	return ret;
 
-unreg_debugfs:
-	batadv_debugfs_del_meshif(dev);
 free_bat_counters:
 	free_percpu(bat_priv->bat_counters);
+	bat_priv->bat_counters = NULL;
 
 	return ret;
 }
-- 
1.8.2.1

Re: [B.A.T.M.A.N.] [PATCHv3] batman-adv: Avoid double freeing of bat_counters

[Marek Lindner]

On Thursday, April 18, 2013 03:13:16 Martin Hundebøll wrote:
> On errors in batadv_mesh_init(), bat_counters will be freed in both
> batadv_mesh_free() and batadv_softif_init_late(). This patch fixes this
> by returning earlier from batadv_softif_init_late() in case of errors in
> batadv_mesh_init() and by setting bat_counters to NULL after freeing.
> 
> Signed-off-by: Martin Hundebøll <martin@hundeboll.net>
> ---
> v2:
>   Removed label as suggested by Antonio
> v3:
>   Set bat_counters to NULL after freeing
> 
>  main.c           | 1 +
>  soft-interface.c | 9 ++++-----
>  2 files changed, 5 insertions(+), 5 deletions(-)

Applied in revision b10ac71 with minor modifications.

Thanks,
Marek

[B.A.T.M.A.N.] (no subject)

[Antonio Quartulli]

Hello David,

this is another small patch for net/linux-3.10. It is preventing a double free
of the bat_counters in case of mesh initialisation failure.

Sorry for sending such small pull requests (I guess this is not that bad since
they target net :-)), but these are small glitches we are finding while testing
new features.

Please pull or let me know if there is any problem.

Thanks a lot,
	Antonio


The following changes since commit 3ccfc1b1d2fa78f8ece83646027982916fcc794b:

  Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless (2013-05-20 14:05:22 -0700)

are available in the git repository at:


  git://git.open-mesh.org/linux-merge.git tags/batman-adv-fix-for-davem

for you to fetch changes up to f69ae770e74df420fbcf93aae81b30a5dcc73b7d:

  batman-adv: Avoid double freeing of bat_counters (2013-05-21 21:34:36 +0200)

----------------------------------------------------------------
Included change:
- fix double free in case of failure during mesh initialisation

----------------------------------------------------------------
Martin Hundebøll (1):
      batman-adv: Avoid double freeing of bat_counters

 net/batman-adv/main.c           | 1 +
 net/batman-adv/soft-interface.c | 1 +
 2 files changed, 2 insertions(+)

[B.A.T.M.A.N.] [PATCH] batman-adv: Avoid double freeing of bat_counters

[Antonio Quartulli]

From: Martin Hundebøll <martin@hundeboll.net>

On errors in batadv_mesh_init(), bat_counters will be freed in both
batadv_mesh_free() and batadv_softif_init_late(). This patch fixes this
by returning earlier from batadv_softif_init_late() in case of errors in
batadv_mesh_init() and by setting bat_counters to NULL after freeing.

Signed-off-by: Martin Hundebøll <martin@hundeboll.net>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
Signed-off-by: Antonio Quartulli <ordex@autistici.org>
---
 net/batman-adv/main.c           | 1 +
 net/batman-adv/soft-interface.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index 1240f07..51aafd6 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -181,6 +181,7 @@ void batadv_mesh_free(struct net_device *soft_iface)
 	batadv_originator_free(bat_priv);
 
 	free_percpu(bat_priv->bat_counters);
+	bat_priv->bat_counters = NULL;
 
 	atomic_set(&bat_priv->mesh_state, BATADV_MESH_INACTIVE);
 }
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 6f20d33..819dfb0 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -505,6 +505,7 @@ unreg_debugfs:
 	batadv_debugfs_del_meshif(dev);
 free_bat_counters:
 	free_percpu(bat_priv->bat_counters);
+	bat_priv->bat_counters = NULL;
 
 	return ret;
 }
-- 
1.8.1.5