The following commit has been merged in the merge/master branch: commit 4729a33528e05ea858d8337769584cb49961fc0e Author: Marek Lindner mareklindner@neomailbox.ch Date: Mon Jun 22 00:30:23 2015 +0800

batman-adv: prevent potential hlist double deletion

The hlist_del_rcu() call in batadv_tt_global_size_mod() does not check if the element still is part of the list prior to deletion. The atomic list counter should prevent the worst but converting to hlist_del_init_rcu() ensures the element can't be deleted more than once.

Signed-off-by: Marek Lindner mareklindner@neomailbox.ch Acked-by: Antonio Quartulli antonio@meshcoding.com

diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index e20d98e..1976816 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -315,7 +315,7 @@ static void batadv_tt_global_size_mod(struct batadv_orig_node *orig_node,

if (atomic_add_return(v, &vlan->tt.num_entries) == 0) { spin_lock_bh(&orig_node->vlan_list_lock); - hlist_del_rcu(&vlan->list); + hlist_del_init_rcu(&vlan->list); spin_unlock_bh(&orig_node->vlan_list_lock); batadv_orig_node_vlan_free_ref(vlan); }