Re: [B.A.T.M.A.N.] [PATCH v3 1/2] batman-adv: fix race conditions on interface removal

[Sven Eckelmann <sven@narfation.org>]

[-- Attachment #1: Type: text/plain, Size: 2253 bytes --]

On Montag, 31. Oktober 2016 08:22:17 CET Linus Lüssing wrote:
[...]
> Hm, ah. I think I had that first, but then noticed it doesn't
> work. For the fake-approach to work, I need to be able to
> distinguish a stealing from batadv_forw_packet_steal() and
> batadv_forw_packet_list_steal().
> 
> Note, that the former has the extra hlist_add_head(bm_list) to a
> stack hlist_head while the latter hasn't.
> 
> 
> The three, potential cases to distinguish in
> batadv_forw_packet_queue() are:
> 
> OK-case 1): 
> - Not stolen yet, we may requeue
>   (hlist_unhashed(bm_list))
> 
> OK-case 2):
> - stolen by purging thread, batadv_forw_packet_list_steal(),
>   we may not requeue
>   (!hlist_unhashed(bm_list) && !hlist_fake(bm_list))

> 
> ERROR-case:
> - someone called batadv_forw_packet_steal() and

Wait a second. batadv_forw_packet_steal will do following:

> +	hlist_add_head(&forw_packet->bm_list, &head);

So forw_packet->bm_list's next will point to NULL.
The pprev will point to head's first.
head's first will point to forw_packet (but this can be ignored).

> +	hlist_add_fake(&forw_packet->bm_list);

forw_packet->bm_list's pprev will now point to its own next.

So it is !hlist_unhashed && hlist_fake(bm_list).

So it is the same as:

    INIT_HLIST_NODE(&forw_packet->bm_list);
    hlist_add_fake(&forw_packet->bm_list);

I still don't get why the hlist_add_head with a pseudo head
is necessary.


>   then batadv_forw_packet_queue() was called afterwards
>   (!hlist_unhashed(bm_list) && hlist_fake(bm_list))

[...]

> Only doing the hlist_add_fake(bm_list) without the previous
> hlist_add_head() in batadv_forw_packet_steal() would lead to
> "hlist_fake(bm_list)" becoming true, like we'd want it to
> and need to detect the ERROR-case, right.
> 
> Unfortunately, a plain hlist_add_fake(bm_list) then sets
> bm_list->pprev = bm_list->next = NULL. Which results in:
> 
>   hlist_unhashed(bm_list) (= OK-case 1), not what we want)

No, this is not what happens. bm_list->pprev is set by
hlist_add_fake to &bm_list->next and not to bm_list->next.

> Does that clarify why the previous hlist_add_head() in
> batadv_forw_packet_steal() is done?

No.

Kind regards,
	Sven

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 801 bytes --]