On Tuesday, July 14, 2015 00:05:22 Marek Lindner wrote:
curr_gw = batadv_gw_get_selected_gw_node(bat_priv); if (gw_node == curr_gw) batadv_gw_reselect(bat_priv);
if (curr_gw)
batadv_gw_node_free_ref(curr_gw); }
out:
if (curr_gw)
batadv_gw_node_free_ref(curr_gw); if (gw_node) batadv_gw_node_free_ref(gw_node);
}
After the batadv_gw_node_free_ref() 'bat_priv->gw.curr_gw' points to random memory ...
I stand corrected. bat_priv->gw.curr_gw has its own refcounter to protect it from accidental deletion.
Cheers, Marek