diff mbox

[v3,maint] batman-adv: protect tt request from double deletion

Message ID 1434904911-12504-1-git-send-email-mareklindner@neomailbox.ch (mailing list archive)
State Accepted, archived
Commit 9bac35c1e4fab662522371f81147963e19693409
Headers

Commit Message

Marek Lindner June 21, 2015, 4:41 p.m. UTC 
  The list_del() calls were changed to list_del_init() to prevent
an accidental double deletion in batadv_tt_req_node_new().

Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
---
v3: rebase on maint & removed hlist conversion
v2: removed redundant hlist_unhashed() check & reword commit message

 translation-table.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

Comments

Antonio Quartulli June 22, 2015, 4:31 p.m. UTC | #1 
On 21/06/15 18:41, Marek Lindner wrote:
> The list_del() calls were changed to list_del_init() to prevent
> an accidental double deletion in batadv_tt_req_node_new().
> 
> Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>

Acked-by: Antonio Quartulli <antonio@meshcoding.com>
Marek Lindner June 24, 2015, 8:07 a.m. UTC | #2 
On Monday, June 22, 2015 18:31:39 Antonio Quartulli wrote:
> Signed by antonio@meshcoding.com.	Show Details
> 
> On 21/06/15 18:41, Marek Lindner wrote:
> > The list_del() calls were changed to list_del_init() to prevent
> > an accidental double deletion in batadv_tt_req_node_new().
> >
> > 
> >
> > Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
> 
> Acked-by: Antonio Quartulli <antonio@meshcoding.com>

Applied in revision 9bac35c.

Regards,
Marek
diff mbox

Patch

diff --git a/translation-table.c b/translation-table.c
index dfe8896..b6c0f52 100644
--- a/translation-table.c
+++ b/translation-table.c
@@ -2194,7 +2194,7 @@  static void batadv_tt_req_list_free(struct batadv_priv *bat_priv)
 	spin_lock_bh(&bat_priv->tt.req_list_lock);
 
 	list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
-		list_del(&node->list);
+		list_del_init(&node->list);
 		kfree(node);
 	}
 
@@ -2230,7 +2230,7 @@  static void batadv_tt_req_purge(struct batadv_priv *bat_priv)
 	list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
 		if (batadv_has_timed_out(node->issued_at,
 					 BATADV_TT_REQUEST_TIMEOUT)) {
-			list_del(&node->list);
+			list_del_init(&node->list);
 			kfree(node);
 		}
 	}
@@ -2512,7 +2512,8 @@  out:
 		batadv_hardif_free_ref(primary_if);
 	if (ret && tt_req_node) {
 		spin_lock_bh(&bat_priv->tt.req_list_lock);
-		list_del(&tt_req_node->list);
+		/* list_del_init() verifies tt_req_node still is in the list */
+		list_del_init(&tt_req_node->list);
 		spin_unlock_bh(&bat_priv->tt.req_list_lock);
 		kfree(tt_req_node);
 	}
@@ -2949,7 +2950,7 @@  static void batadv_handle_tt_response(struct batadv_priv *bat_priv,
 	list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
 		if (!batadv_compare_eth(node->addr, resp_src))
 			continue;
-		list_del(&node->list);
+		list_del_init(&node->list);
 		kfree(node);
 	}