diff options
| author |   Simon Wunderlich <simon@open-mesh.com> | 2015-06-24 14:50:19 +0200 |
|---|---|---|
| committer |   Antonio Quartulli <antonio@meshcoding.com> | 2015-08-05 00:31:47 +0200 |
| commit | 27a4d5efd417b6ef3190e9af357715532d4617a3 (patch) | |
| tree | f5ca6408c633f58c211a2b1e3b1e2b9347470382 /net/batman-adv | |
| parent | batman-adv: protect tt_local_entry from concurrent delete events (diff) | |
| download | linux-dev-27a4d5efd417b6ef3190e9af357715532d4617a3.tar.xz linux-dev-27a4d5efd417b6ef3190e9af357715532d4617a3.zip | |
batman-adv: initialize up/down values when adding a gateway
Without this initialization, gateways which actually announce up/down
bandwidth of 0/0 could be added. If these nodes get purged via
_batadv_purge_orig() later, the gw_node structure does not get removed
since batadv_gw_node_delete() updates the gw_node with up/down
bandwidth of 0/0, and the updating function then discards the change
and does not free gw_node.
This results in leaking the gw_node structures, which references other
structures: gw_node -> orig_node -> orig_node_ifinfo -> hardif. When
removing the interface later, the open reference on the hardif may cause
hangs with the infamous "unregister_netdevice: waiting for mesh1 to
become free. Usage count = 1" message.
Signed-off-by: Simon Wunderlich <simon@open-mesh.com>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>
Diffstat (limited to 'net/batman-adv')
| -rw-r--r-- | net/batman-adv/gateway_client.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c index bb0158620628..cffa92dd9877 100644 --- a/net/batman-adv/gateway_client.c +++ b/net/batman-adv/gateway_client.c @@ -439,6 +439,8 @@ static void batadv_gw_node_add(struct batadv_priv *bat_priv, INIT_HLIST_NODE(&gw_node->list); gw_node->orig_node = orig_node; + gw_node->bandwidth_down = ntohl(gateway->bandwidth_down); + gw_node->bandwidth_up = ntohl(gateway->bandwidth_up); atomic_set(&gw_node->refcount, 1); spin_lock_bh(&bat_priv->gw.list_lock); |