[B.A.T.M.A.N.] [PATCH] batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq

[B.A.T.M.A.N.] [PATCH] batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq

[Sven Eckelmann]

The originator node object orig_neigh_node is used to when accessing the
bcast_own(_sum) and real_packet_count information. The access to them has
to be protected with the spinlock in orig_neigh_node.

But the function uses the lock in orig_node instead. This is incorrect
because they could be two different originator node objects.

Fixes: f14416760b62 ("batman-adv: protect bit operations to count OGMs with spinlock")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
WARNING: This is only compile tested

Cc: Marek Lindner <mareklindner@neomailbox.ch>
Cc: Linus Lüssing <linus.luessing@c0d3.blue>
---
 net/batman-adv/bat_iv_ogm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 1b659ab6..bbe8414b 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -1214,7 +1214,7 @@ static bool batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node,
 	orig_node->last_seen = jiffies;
 
 	/* find packet count of corresponding one hop neighbor */
-	spin_lock_bh(&orig_node->bat_iv.ogm_cnt_lock);
+	spin_lock_bh(&orig_neigh_node->bat_iv.ogm_cnt_lock);
 	if_num = if_incoming->if_num;
 	orig_eq_count = orig_neigh_node->bat_iv.bcast_own_sum[if_num];
 	neigh_ifinfo = batadv_neigh_ifinfo_new(neigh_node, if_outgoing);
@@ -1224,7 +1224,7 @@ static bool batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node,
 	} else {
 		neigh_rq_count = 0;
 	}
-	spin_unlock_bh(&orig_node->bat_iv.ogm_cnt_lock);
+	spin_unlock_bh(&orig_neigh_node->bat_iv.ogm_cnt_lock);
 
 	/* pay attention to not get a value bigger than 100 % */
 	if (orig_eq_count > neigh_rq_count)
-- 
2.11.0

Re: [B.A.T.M.A.N.] [PATCH] batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq

[Simon Wunderlich]

[-- Attachment #1: Type: text/plain, Size: 602 bytes --]

On Sunday, December 3, 2017 11:26:45 AM CET Sven Eckelmann wrote:
> The originator node object orig_neigh_node is used to when accessing the
> bcast_own(_sum) and real_packet_count information. The access to them has
> to be protected with the spinlock in orig_neigh_node.
> 
> But the function uses the lock in orig_node instead. This is incorrect
> because they could be two different originator node objects.
> 
> Fixes: f14416760b62 ("batman-adv: protect bit operations to count OGMs with
> spinlock") Signed-off-by: Sven Eckelmann <sven@narfation.org>

Applied in 9a3b1954.

Thank you,
      Simon

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]