Re: [PATCH 1/9] mac80211: Fix RCU pointer dereference in mesh_path_discard_frame()

On Thu, 25 Aug 2011 11:16:50 -0700, Javier Cardona wrote:

On Wed, Aug 24, 2011 at 7:08 PM, Johannes Berg
[off-list ref] wrote:

quoted

On Wed, 24 Aug 2011 18:40:44 -0700, Thomas Pedersen wrote:

quoted

               da = hdr->addr3;
               ra = hdr->addr1;
+               rcu_read_lock();
               mpath = mesh_path_lookup(da, sdata);
+               rcu_read_unlock();
               if (mpath)
                       sn = ++mpath->sn;
               mesh_path_error_tx(sdata->u.mesh.mshcfg.element_ttl,
skb->data,

You've got to be kidding. Didn't I just explain RCU :)

The patch was prepared before your RCU session :(
Just to confirm I got it right before we resubmit: given that not 
only
the path table accessed inside mesh_path_lookup() but also the mpaths
themselves are RCU protected, the right fix should have been

               da = hdr->addr3;
               ra = hdr->addr1;
+             rcu_read_lock();
               mpath = mesh_path_lookup(da, sdata);
               if (mpath)
                       sn = ++mpath->sn;
+             rcu_read_unlock();
               mesh_path_error_tx(sdata->u.mesh.mshcfg.element_ttl,
skb->data,

Correct?

Frankly, I'm not sure, since you modify the mpath->sn you probably need 
to hold a real lock, otherwise ++mpath->sn can race against itself in 
this very function.

johannes