Repository : ssh://git@open-mesh.org/batman-adv

On branch : maint

commit 9bac35c1e4fab662522371f81147963e19693409 Author: Marek Lindner mareklindner@neomailbox.ch Date: Mon Jun 22 00:36:28 2015 +0800

batman-adv: protect tt request from double deletion

The list_del() calls were changed to list_del_init() to prevent an accidental double deletion in batadv_tt_req_node_new().

Signed-off-by: Marek Lindner mareklindner@neomailbox.ch Acked-by: Antonio Quartulli antonio@meshcoding.com

9bac35c1e4fab662522371f81147963e19693409 translation-table.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/translation-table.c b/translation-table.c index dfe8896..b6c0f52 100644 --- a/translation-table.c +++ b/translation-table.c @@ -2194,7 +2194,7 @@ static void batadv_tt_req_list_free(struct batadv_priv *bat_priv) spin_lock_bh(&bat_priv->tt.req_list_lock);

list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) { - list_del(&node->list); + list_del_init(&node->list); kfree(node); }

@@ -2230,7 +2230,7 @@ static void batadv_tt_req_purge(struct batadv_priv *bat_priv) list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) { if (batadv_has_timed_out(node->issued_at, BATADV_TT_REQUEST_TIMEOUT)) { - list_del(&node->list); + list_del_init(&node->list); kfree(node); } } @@ -2512,7 +2512,8 @@ out: batadv_hardif_free_ref(primary_if); if (ret && tt_req_node) { spin_lock_bh(&bat_priv->tt.req_list_lock); - list_del(&tt_req_node->list); + /* list_del_init() verifies tt_req_node still is in the list */ + list_del_init(&tt_req_node->list); spin_unlock_bh(&bat_priv->tt.req_list_lock); kfree(tt_req_node); } @@ -2949,7 +2950,7 @@ static void batadv_handle_tt_response(struct batadv_priv *bat_priv, list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) { if (!batadv_compare_eth(node->addr, resp_src)) continue; - list_del(&node->list); + list_del_init(&node->list); kfree(node); }