Repository : ssh://git@open-mesh.org/batman-adv
On branch : maint
>---------------------------------------------------------------
commit 9bac35c1e4fab662522371f81147963e19693409
Author: Marek Lindner <mareklindner(a)neomailbox.ch>
Date: Mon Jun 22 00:36:28 2015 +0800
batman-adv: protect tt request from double deletion
The list_del() calls were changed to list_del_init() to prevent
an accidental double deletion in batadv_tt_req_node_new().
Signed-off-by: Marek Lindner <mareklindner(a)neomailbox.ch>
Acked-by: Antonio Quartulli <antonio(a)meshcoding.com>
>---------------------------------------------------------------
9bac35c1e4fab662522371f81147963e19693409
translation-table.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/translation-table.c b/translation-table.c
index dfe8896..b6c0f52 100644
--- a/translation-table.c
+++ b/translation-table.c
@@ -2194,7 +2194,7 @@ static void batadv_tt_req_list_free(struct batadv_priv *bat_priv)
spin_lock_bh(&bat_priv->tt.req_list_lock);
list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
- list_del(&node->list);
+ list_del_init(&node->list);
kfree(node);
}
@@ -2230,7 +2230,7 @@ static void batadv_tt_req_purge(struct batadv_priv *bat_priv)
list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
if (batadv_has_timed_out(node->issued_at,
BATADV_TT_REQUEST_TIMEOUT)) {
- list_del(&node->list);
+ list_del_init(&node->list);
kfree(node);
}
}
@@ -2512,7 +2512,8 @@ out:
batadv_hardif_free_ref(primary_if);
if (ret && tt_req_node) {
spin_lock_bh(&bat_priv->tt.req_list_lock);
- list_del(&tt_req_node->list);
+ /* list_del_init() verifies tt_req_node still is in the list */
+ list_del_init(&tt_req_node->list);
spin_unlock_bh(&bat_priv->tt.req_list_lock);
kfree(tt_req_node);
}
@@ -2949,7 +2950,7 @@ static void batadv_handle_tt_response(struct batadv_priv *bat_priv,
list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
if (!batadv_compare_eth(node->addr, resp_src))
continue;
- list_del(&node->list);
+ list_del_init(&node->list);
kfree(node);
}