Re: [B.A.T.M.A.N.] batman-adv: Reduce tt_global hash refcnt only for removed entry

[Antonio Quartulli <a@unstable.cc>]

[-- Attachment #1.1: Type: text/plain, Size: 1432 bytes --]

Hi,

On 24/02/2019 00:09, Sven Eckelmann wrote:
> The batadv_hash_remove is a function which searches the hashtable for an
> entry using a needle, a hashtable bucket selection function and a compare
> function. It will lock the bucket list and delete an entry when the compare
> function matches it with the needle. It returns the pointer to the
> hlist_node which matches or NULL when no entry matches the needle.
> 
> The batadv_tt_global_free is not itself protected in anyway to avoid that
> any other function is modifying the hashtable between the search for the
> entry and the call to batadv_hash_remove. It can therefore happen that the
> entry either doesn't exist anymore or an entry was deleted which is not the
> same object as the needle. In such an situation, the reference counter (for
> the reference stored in the hashtable) must not be reduced for the needle.
> Instead the reference counter of the actually removed entry has to be
> reduced.
> 
> Otherwise the reference counter will underflow and the object might be
> freed before all its references were dropped. The kref helpers reported
> this problem as:
> 
>   refcount_t: underflow; use-after-free.
> 
> Fixes: 7bad46397eff ("batman-adv: protect the local and the global trans-tables with rcu")
> Signed-off-by: Sven Eckelmann <sven@narfation.org>
> ---
Acked-by: Antonio Quartulli <a@unstable.cc>

-- 
Antonio Quartulli


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]