[PATCH 6.18 019/109] rose: restart the link of a neighbour created over a live AX.25 connection

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

6.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bernard Pidoux <bernard.f6bvp@gmail.com>

A new neighbour starts with restarted == 0 and waits for the first frame
sent to it to start the restart procedure. But when a neighbour is
removed from the routing tables and added back (SIOCDELRT then
SIOCADDRT, or SIOCRSCLRRT followed by a reload of the routes), the AX.25
connection to it outlives the old entry. The other end has seen nothing:
it still regards the link as restarted and will not restart it. On this
end rose_get_neigh() only hands out restarted neighbours to through
calls, so no frame is ever sent to the new neighbour and nothing starts
the restart either. Every call relayed through that neighbour is then
refused until one of the two ends happens to originate a call of its own
over the link, or the AX.25 connection drops.

This happens on a relay node each time its routing daemon restarts: FPAC
clears and reloads the routes, the neighbours come back as "restart no"
while /proc/net/ax25 still shows their connections established.

When rose_add_node() creates a neighbour and an AX.25 connection to it
already exists, send the RESTART REQUEST right away and start T0, as
rose_transmit_link() does for the first frame. Nothing changes when
there is no connection yet: the link is still brought up on demand.

Tested in QEMU with a lockdep and KASAN kernel, three nodes A - B - C
with A calling C through B, then B removing and re-adding its route to
C (or clearing and reloading all its routes): before, the neighbour
stays "restart no" on B and A's calls to C are refused for as long as
the test runs; after, the neighbour is restarted within three seconds
and the first call goes through. No lockdep, KASAN or refcount report.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Bernard Pidoux <bernard.f6bvp@gmail.com>
(cherry picked from commit 411b950c8862277a53f4afc6c6c5b3ab00b814be)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/rose.h    |  1 +
 net/rose/rose_link.c  | 20 ++++++++++++++++++++
 net/rose/rose_route.c | 10 ++++++++++
 3 files changed, 31 insertions(+)

diff --git a/include/net/rose.h b/include/net/rose.h
index 49140668b3dd0..f5b23c8a11e4d 100644
--- a/include/net/rose.h
+++ b/include/net/rose.h
@@ -237,6 +237,7 @@ void rose_link_rx_restart(struct sk_buff *, struct rose_neigh *,
 			  unsigned short);
 void rose_transmit_clear_request(struct rose_neigh *, unsigned int,
 				 unsigned char, unsigned char);
+void rose_link_restart(struct rose_neigh *neigh);
 void rose_transmit_link(struct sk_buff *, struct rose_neigh *);
 
 /* rose_loopback.c */
diff --git a/net/rose/rose_link.c b/net/rose/rose_link.c
index 36b6778d8e545..20057a39bafaa 100644
--- a/net/rose/rose_link.c
+++ b/net/rose/rose_link.c
@@ -259,6 +259,26 @@ void rose_transmit_clear_request(struct rose_neigh *neigh, unsigned int lci, uns
 		kfree_skb(skb);
 }
 
+/*
+ * A neighbour has just been created while an AX.25 connection to it is
+ * already up, e.g. it was removed from the routing tables and added back.
+ * The other end still regards the link as restarted and will not restart it,
+ * and through calls only use restarted neighbours, so nothing would ever
+ * restart it from this end either: do it now.
+ */
+void rose_link_restart(struct rose_neigh *neigh)
+{
+	if (neigh->loopback || neigh->restarted || rose_t0timer_running(neigh))
+		return;
+
+	if (!rose_link_up(neigh))
+		return;
+
+	rose_transmit_restart_request(neigh);
+	neigh->dce_mode = 0;
+	rose_start_t0timer(neigh);
+}
+
 void rose_transmit_link(struct sk_buff *skb, struct rose_neigh *neigh)
 {
 	unsigned char *dptr;
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index 87844cc195f8d..7ae3552c19267 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -53,6 +53,7 @@ static int __must_check rose_add_node(struct rose_route_struct *rose_route,
 {
 	struct rose_node  *rose_node, *rose_tmpn, *rose_tmpp;
 	struct rose_neigh *rose_neigh;
+	bool new_neigh = false;
 	int i, res = 0;
 
 	spin_lock_bh(&rose_node_list_lock);
@@ -125,6 +126,7 @@ static int __must_check rose_add_node(struct rose_route_struct *rose_route,
 
 		rose_neigh->next = rose_neigh_list;
 		rose_neigh_list  = rose_neigh;
+		new_neigh        = true;
 	}
 
 	/*
@@ -192,6 +194,14 @@ static int __must_check rose_add_node(struct rose_route_struct *rose_route,
 	}
 
 out:
+	/*
+	 * The AX.25 connection of a neighbour that was removed from the tables
+	 * outlives it. If it is still there, the other end will not restart
+	 * the link: do it from here.
+	 */
+	if (new_neigh && res == 0)
+		rose_link_restart(rose_neigh);
+
 	spin_unlock_bh(&rose_neigh_list_lock);
 	spin_unlock_bh(&rose_node_list_lock);
 
-- 
2.53.0