pull request net: batman-adv 20140510

Hello David,

here you have 4 small but important patches from Simon Wunderlich intended
for net/linux-3.15 and *stable/linux-3.14* (please enqueue them).

I know it's rather late in the rc cycle but these 4 changes are addressing
some severe reference counting imbalances in different parts of code.

All these reference counting problems are rather important because they prevent
the netdev object used by batman-adv from being released and then the
system from properly shutdown/reboot/reconfigure by holding the networking stack
with the following (sad) message:

unregister_netdevice: waiting for mesh0 to become free. Usage count = 1


Please pull or let me know of any problem!

Thanks a lot,
	Antonio


The following changes since commit 1448eb566970c6d3cade522419848fdaee24c684:

  Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless (2014-05-09 16:46:53 -0400)

are available in the git repository at:


  git://git.open-mesh.org/linux-merge.git tags/batman-adv-fix-for-davem

for you to fetch changes up to 29bcc8064fc0b82bc708c09577d550923b954e5a:

  batman-adv: fix removing neigh_ifinfo (2014-05-10 10:59:05 +0200)

----------------------------------------------------------------
Included changes:
- properly release neigh_ifinfo in batadv_iv_ogm_process_per_outif()
- properly release orig_ifinfo->router when freeing orig_ifinfo
- properly release neigh_node objects during periodic check
- properly release neigh_info objects when the related hard_iface
  is free'd

These changes are all very important because they fix some
reference counting imbalances that lead to the
impossibility of releasing the netdev object used by
batman-adv on shutdown.
The consequence is that such object cannot be destroyed by
the networking stack (the refcounter does not reach zero)
thus bringing the system in hanging state during a normal
reboot operation or a network reconfiguration.

----------------------------------------------------------------
Simon Wunderlich (4):
      batman-adv: fix neigh_ifinfo imbalance
      batman-adv: fix neigh reference imbalance
      batman-adv: always run purge_orig_neighbors
      batman-adv: fix removing neigh_ifinfo

 net/batman-adv/bat_iv_ogm.c |  2 ++
 net/batman-adv/originator.c | 59 ++++++++++++++++++++++++++++++++++++++++++---
 2 files changed, 57 insertions(+), 4 deletions(-)

From: Simon Wunderlich <redacted>

The neigh_ifinfo object must be freed if it has been used in
batadv_iv_ogm_process_per_outif().

This is a regression introduced by
89652331c00f43574515059ecbf262d26d885717
("batman-adv: split tq information in neigh_node struct")

Reported-by: Antonio Quartulli <redacted>
Signed-off-by: Simon Wunderlich <redacted>
Signed-off-by: Marek Lindner <redacted>
Signed-off-by: Antonio Quartulli <redacted>
---
 net/batman-adv/bat_iv_ogm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index b3bd4ec..f04224c 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c

@@ -1545,6 +1545,8 @@ out_neigh:
 	if ((orig_neigh_node) && (!is_single_hop_neigh))
 		batadv_orig_node_free_ref(orig_neigh_node);
 out:
+	if (router_ifinfo)
+		batadv_neigh_ifinfo_free_ref(router_ifinfo);
 	if (router)
 		batadv_neigh_node_free_ref(router);
 	if (router_router)

-- 
1.8.5.5

From: Simon Wunderlich <redacted>

When an interface is removed from batman-adv, the orig_ifinfo of a
orig_node may be removed without releasing the router first.
This will prevent the reference for the neighbor pointed at by the
orig_ifinfo->router to be released, and this leak may result in
reference leaks for the interface used by this neighbor. Fix that.

This is a regression introduced by
7351a4822d42827ba0110677c0cbad88a3d52585
("batman-adv: split out router from orig_node").

Reported-by: Antonio Quartulli <redacted>
Signed-off-by: Simon Wunderlich <redacted>
Signed-off-by: Marek Lindner <redacted>
Signed-off-by: Antonio Quartulli <redacted>
---
 net/batman-adv/originator.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index ffd9dfb..a43da69 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c

@@ -501,12 +501,17 @@ batadv_neigh_node_get(const struct batadv_orig_node *orig_node,
 static void batadv_orig_ifinfo_free_rcu(struct rcu_head *rcu)
 {
 	struct batadv_orig_ifinfo *orig_ifinfo;
+	struct batadv_neigh_node *router;
 
 	orig_ifinfo = container_of(rcu, struct batadv_orig_ifinfo, rcu);
 
 	if (orig_ifinfo->if_outgoing != BATADV_IF_DEFAULT)
 		batadv_hardif_free_ref_now(orig_ifinfo->if_outgoing);
 
+	/* this is the last reference to this object */
+	router = rcu_dereference_protected(orig_ifinfo->router, true);
+	if (router)
+		batadv_neigh_node_free_ref_now(router);
 	kfree(orig_ifinfo);
 }
 

-- 
1.8.5.5

From: Simon Wunderlich <redacted>

When an interface is removed separately, all neighbors need to be
checked if they have a neigh_ifinfo structure for that particular
interface. If that is the case, remove that ifinfo so any references to
a hard interface can be freed.

This is a regression introduced by
89652331c00f43574515059ecbf262d26d885717
("batman-adv: split tq information in neigh_node struct")

Reported-by: Antonio Quartulli <redacted>
Signed-off-by: Simon Wunderlich <redacted>
Signed-off-by: Marek Lindner <redacted>
Signed-off-by: Antonio Quartulli <redacted>
---
 net/batman-adv/originator.c | 46 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 8104c3c..427c07d 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c

@@ -707,6 +707,47 @@ free_orig_node:
 }
 
 /**
+ * batadv_purge_neigh_ifinfo - purge obsolete ifinfo entries from neighbor
+ * @bat_priv: the bat priv with all the soft interface information
+ * @neigh_node: orig node which is to be checked
+ */
+static void
+batadv_purge_neigh_ifinfo(struct batadv_priv *bat_priv,
+			  struct batadv_neigh_node *neigh)
+{
+	struct batadv_neigh_ifinfo *neigh_ifinfo;
+	struct batadv_hard_iface *if_outgoing;
+	struct hlist_node *node_tmp;
+
+	spin_lock_bh(&neigh->ifinfo_lock);
+
+	/* for all ifinfo objects for this neighinator */
+	hlist_for_each_entry_safe(neigh_ifinfo, node_tmp,
+				  &neigh->ifinfo_list, list) {
+		if_outgoing = neigh_ifinfo->if_outgoing;
+
+		/* always keep the default interface */
+		if (if_outgoing == BATADV_IF_DEFAULT)
+			continue;
+
+		/* don't purge if the interface is not (going) down */
+		if ((if_outgoing->if_status != BATADV_IF_INACTIVE) &&
+		    (if_outgoing->if_status != BATADV_IF_NOT_IN_USE) &&
+		    (if_outgoing->if_status != BATADV_IF_TO_BE_REMOVED))
+			continue;
+
+		batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
+			   "neighbor/ifinfo purge: neighbor %pM, iface: %s\n",
+			   neigh->addr, if_outgoing->net_dev->name);
+
+		hlist_del_rcu(&neigh_ifinfo->list);
+		batadv_neigh_ifinfo_free_ref(neigh_ifinfo);
+	}
+
+	spin_unlock_bh(&neigh->ifinfo_lock);
+}
+
+/**
  * batadv_purge_orig_ifinfo - purge obsolete ifinfo entries from originator
  * @bat_priv: the bat priv with all the soft interface information
  * @orig_node: orig node which is to be checked

@@ -805,6 +846,11 @@ batadv_purge_orig_neighbors(struct batadv_priv *bat_priv,
 
 			hlist_del_rcu(&neigh_node->list);
 			batadv_neigh_node_free_ref(neigh_node);
+		} else {
+			/* only neccesary if not the whole neighbor is to be deleted,
+			 * but some interface has been removed.
+			 */
+			batadv_purge_neigh_ifinfo(bat_priv, neigh_node);
 		}
 	}
 

-- 
1.8.5.5

From: Simon Wunderlich <redacted>

The current code will not execute batadv_purge_orig_neighbors() when an
orig_ifinfo has already been purged. However we need to run it in any
case. Fix that.

This is a regression introduced by
7351a4822d42827ba0110677c0cbad88a3d52585
("batman-adv: split out router from orig_node")

Signed-off-by: Simon Wunderlich <redacted>
Signed-off-by: Marek Lindner <redacted>
Signed-off-by: Antonio Quartulli <redacted>
---
 net/batman-adv/originator.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index a43da69..8104c3c 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c

@@ -862,7 +862,7 @@ static bool batadv_purge_orig_node(struct batadv_priv *bat_priv,
 {
 	struct batadv_neigh_node *best_neigh_node;
 	struct batadv_hard_iface *hard_iface;
-	bool changed;
+	bool changed_ifinfo, changed_neigh;
 
 	if (batadv_has_timed_out(orig_node->last_seen,
 				 2 * BATADV_PURGE_TIMEOUT)) {

@@ -872,10 +872,10 @@ static bool batadv_purge_orig_node(struct batadv_priv *bat_priv,
 			   jiffies_to_msecs(orig_node->last_seen));
 		return true;
 	}
-	changed = batadv_purge_orig_ifinfo(bat_priv, orig_node);
-	changed = changed || batadv_purge_orig_neighbors(bat_priv, orig_node);
+	changed_ifinfo = batadv_purge_orig_ifinfo(bat_priv, orig_node);
+	changed_neigh = batadv_purge_orig_neighbors(bat_priv, orig_node);
 
-	if (!changed)
+	if (!changed_ifinfo && !changed_neigh)
 		return false;
 
 	/* first for NULL ... */

-- 
1.8.5.5

On 10/05/14 17:35, Antonio Quartulli wrote:

The following changes since commit 1448eb566970c6d3cade522419848fdaee24c684:

  Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless (2014-05-09 16:46:53 -0400)

are available in the git repository at:


  git://git.open-mesh.org/linux-merge.git tags/batman-adv-fix-for-davem

for you to fetch changes up to 29bcc8064fc0b82bc708c09577d550923b954e5a:

The tag points now to 05191f523653461ca6a4e4fb38012e0d8f3c5641 because I
fixed a too long line.


Cheers,

-- 
Antonio Quartulli

Hello.

On 05/10/2014 07:35 PM, Antonio Quartulli wrote:

From: Simon Wunderlich <redacted>

When an interface is removed separately, all neighbors need to be
checked if they have a neigh_ifinfo structure for that particular
interface. If that is the case, remove that ifinfo so any references to
a hard interface can be freed.

This is a regression introduced by
89652331c00f43574515059ecbf262d26d885717
("batman-adv: split tq information in neigh_node struct")

Reported-by: Antonio Quartulli <redacted>
Signed-off-by: Simon Wunderlich <redacted>
Signed-off-by: Marek Lindner <redacted>
Signed-off-by: Antonio Quartulli <redacted>
---
  net/batman-adv/originator.c | 46 +++++++++++++++++++++++++++++++++++++++++++++
  1 file changed, 46 insertions(+)

    The corresponding parameter is called just 'neigh'.

+ */
+static void
+batadv_purge_neigh_ifinfo(struct batadv_priv *bat_priv,
+			  struct batadv_neigh_node *neigh)

[...]

WBR, Sergei

On 10/05/14 17:40, Antonio Quartulli wrote:

On 10/05/14 17:35, Antonio Quartulli wrote:

quoted

The following changes since commit 1448eb566970c6d3cade522419848fdaee24c684:

  Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless (2014-05-09 16:46:53 -0400)

are available in the git repository at:


  git://git.open-mesh.org/linux-merge.git tags/batman-adv-fix-for-davem

for you to fetch changes up to 29bcc8064fc0b82bc708c09577d550923b954e5a:

The tag points now to 05191f523653461ca6a4e4fb38012e0d8f3c5641 because I
fixed a too long line.

David,

the batman-adv-fix-for-davem tag now points to
709de13f0c532fe9c468c094aff069a725ed57fe which contains the fix for the
long line I said before, the fix for the kerneldoc as suggested by
Sergei and a correction of a small typ0.


I can re-send the whole pull request if you want, but I wanted to avoid
to create more noise, unless it is needed.

Thanks a lot.


Cheers,

-- 
Antonio Quartulli

From: Antonio Quartulli <redacted>
Date: Sat, 10 May 2014 17:35:06 +0200

here you have 4 small but important patches from Simon Wunderlich intended
for net/linux-3.15 and *stable/linux-3.14* (please enqueue them).

I know it's rather late in the rc cycle but these 4 changes are addressing
some severe reference counting imbalances in different parts of code.

Pulled and queued up for -stable, thanks.