From patchwork Sun Jun 21 16:41:51 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marek Lindner X-Patchwork-Id: 4544 Return-Path: Received-SPF: Softfail (domain owner discourages use of this host) identity=mailfrom; client-ip=5.148.176.57; helo=s1.neomailbox.net; envelope-from=mareklindner@neomailbox.ch; receiver=b.a.t.m.a.n@lists.open-mesh.org Received: from s1.neomailbox.net (s1.neomailbox.net [5.148.176.57]) by open-mesh.org (Postfix) with ESMTPS id 6E753601008 for ; Sun, 21 Jun 2015 18:42:01 +0200 (CEST) From: Marek Lindner To: b.a.t.m.a.n@lists.open-mesh.org Date: Mon, 22 Jun 2015 00:41:51 +0800 Message-Id: <1434904911-12504-1-git-send-email-mareklindner@neomailbox.ch> Cc: Marek Lindner Subject: [B.A.T.M.A.N.] [PATCHv3 maint] batman-adv: protect tt request from double deletion X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Jun 2015 16:42:01 -0000 The list_del() calls were changed to list_del_init() to prevent an accidental double deletion in batadv_tt_req_node_new(). Signed-off-by: Marek Lindner Acked-by: Antonio Quartulli --- v3: rebase on maint & removed hlist conversion v2: removed redundant hlist_unhashed() check & reword commit message translation-table.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/translation-table.c b/translation-table.c index dfe8896..b6c0f52 100644 --- a/translation-table.c +++ b/translation-table.c @@ -2194,7 +2194,7 @@ static void batadv_tt_req_list_free(struct batadv_priv *bat_priv) spin_lock_bh(&bat_priv->tt.req_list_lock); list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) { - list_del(&node->list); + list_del_init(&node->list); kfree(node); } @@ -2230,7 +2230,7 @@ static void batadv_tt_req_purge(struct batadv_priv *bat_priv) list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) { if (batadv_has_timed_out(node->issued_at, BATADV_TT_REQUEST_TIMEOUT)) { - list_del(&node->list); + list_del_init(&node->list); kfree(node); } } @@ -2512,7 +2512,8 @@ out: batadv_hardif_free_ref(primary_if); if (ret && tt_req_node) { spin_lock_bh(&bat_priv->tt.req_list_lock); - list_del(&tt_req_node->list); + /* list_del_init() verifies tt_req_node still is in the list */ + list_del_init(&tt_req_node->list); spin_unlock_bh(&bat_priv->tt.req_list_lock); kfree(tt_req_node); } @@ -2949,7 +2950,7 @@ static void batadv_handle_tt_response(struct batadv_priv *bat_priv, list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) { if (!batadv_compare_eth(node->addr, resp_src)) continue; - list_del(&node->list); + list_del_init(&node->list); kfree(node); }