Repository : ssh://git@open-mesh.org/batman-adv
On branch : next
>---------------------------------------------------------------
commit d1059685e5abf1d63e7938292dd332d376f086e1
Merge: fbb98aa 08ba64d
Author: Marek Lindner <mareklindner(a)neomailbox.ch>
Date: Sun Mar 27 15:51:40 2016 +0800
Merge branch 'maint' into next
>---------------------------------------------------------------
d1059685e5abf1d63e7938292dd332d376f086e1
net/batman-adv/routing.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --cc net/batman-adv/routing.c
index 4dd646a,7b260e1..b781bf7
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@@ -105,9 -104,18 +105,18 @@@ static void _batadv_update_route(struc
neigh_node = NULL;
spin_lock_bh(&orig_node->neigh_list_lock);
+ /* curr_router used earlier may not be the current orig_ifinfo->router
+ * anymore because it was dereferenced outside of the neigh_list_lock
+ * protected region. After the new best neighbor has replace the current
+ * best neighbor the reference counter needs to decrease. Consequently,
+ * the code needs to ensure the curr_router variable contains a pointer
+ * to the replaced best neighbor.
+ */
+ curr_router = rcu_dereference_protected(orig_ifinfo->router, true);
+
rcu_assign_pointer(orig_ifinfo->router, neigh_node);
spin_unlock_bh(&orig_node->neigh_list_lock);
- batadv_orig_ifinfo_free_ref(orig_ifinfo);
+ batadv_orig_ifinfo_put(orig_ifinfo);
/* decrease refcount of previous best neighbor */
if (curr_router)