The hash iterator of a hash has different pointers inside of it. When somebody tries to delete a bucket in another hash with hash_remove_bucket most data will be changed in the hash the iterator belongs and not the target hash. --- batman/linux/modules/gateway.c | 2 +- batman/linux/modules/gateway24.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/batman/linux/modules/gateway.c b/batman/linux/modules/gateway.c index 1f2dc24..fcf4dd2 100644 --- a/batman/linux/modules/gateway.c +++ b/batman/linux/modules/gateway.c @@ -383,7 +383,7 @@ static int packet_recv_thread(void *data) if( ( jiffies - client_data->last_keep_alive ) / HZ > LEASE_TIME ) {

hash_remove_bucket(wip_hash, hashit); - hash_remove_bucket(vip_hash, hashit); + hash_remove(vip_hash, client_data);

tmp_entry = kmalloc(sizeof(struct free_client_data), GFP_KERNEL); if(tmp_entry != NULL) { diff --git a/batman/linux/modules/gateway24.c b/batman/linux/modules/gateway24.c index a8d58e6..e26154b 100644 --- a/batman/linux/modules/gateway24.c +++ b/batman/linux/modules/gateway24.c @@ -364,7 +364,7 @@ static int packet_recv_thread(void *data) if( ( jiffies - client_data->last_keep_alive ) / HZ > LEASE_TIME ) {

hash_remove_bucket(wip_hash, hashit); - hash_remove_bucket(vip_hash, hashit); + hash_remove(vip_hash, client_data);

tmp_entry = kmalloc(sizeof(struct free_client_data), GFP_KERNEL); if(tmp_entry != NULL) {