From patchwork Sun Jan 31 12:27:59 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sven Eckelmann X-Patchwork-Id: 5030 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=79.140.41.39; helo=v3-1039.vlinux.de; envelope-from=sven@narfation.org; receiver=b.a.t.m.a.n@lists.open-mesh.org Authentication-Results: open-mesh.org; dmarc=pass header.from=narfation.org Authentication-Results: open-mesh.org; dkim=pass reason="1024-bit key; unprotected key" header.d=narfation.org header.i=@narfation.org header.b=LX3u6LsT; dkim-adsp=pass; dkim-atps=neutral Received: from v3-1039.vlinux.de (narfation.org [79.140.41.39]) by open-mesh.org (Postfix) with ESMTPS id 84B048076C for ; Sun, 31 Jan 2016 13:28:09 +0100 (CET) Received: from sven-desktop.home.narfation.org (p200300C593C398FD0000000000002E16.dip0.t-ipconnect.de [IPv6:2003:c5:93c3:98fd::2e16]) by v3-1039.vlinux.de (Postfix) with ESMTPSA id D2B211100E7; Sun, 31 Jan 2016 13:28:08 +0100 (CET) Authentication-Results: v3-1039.vlinux.de; dmarc=none header.from=narfation.org DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=narfation.org; s=20121; t=1454243289; bh=Diw59gv7EHHGlp9cvTeMnc9Kv7OEGM9sUkUqBGvhWAA=; h=From:To:Cc:Subject:Date:From; b=LX3u6LsTmo4LQl2it2QetaIwdXpDvoab5AIzklCdh3BgqAqlR4TEBKKONKxCWcPaC AS1hX1uWvybja+9PAmbLPTwK0/uqZL3QNMSQtT6J2zo3O/+GICYv6f1cEA2ooc3Mk0 5Ii8NCJ8pRC9zJYWUYXJG+hhDNnQMOxRCvbhhJbI= From: Sven Eckelmann To: b.a.t.m.a.n@lists.open-mesh.org Date: Sun, 31 Jan 2016 13:27:59 +0100 Message-Id: <1454243280-15126-1-git-send-email-sven@narfation.org> X-Mailer: git-send-email 2.7.0 Subject: [B.A.T.M.A.N.] [PATCH-maint 1/2] batman-adv: Only put gw_node list reference when removed X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 31 Jan 2016 12:28:09 -0000 The batadv_gw_node reference counter in batadv_gw_node_update can only be reduced when the list entry was actually removed. Otherwise the reference counter may reach zero when batadv_gw_node_update is called from two different contexts for the same gw_node but only one context is actually removing the entry from the list. The release function for this gw_node is not called inside the list_lock spinlock protected region because the function batadv_gw_node_update still holds a gw_node reference for the object pointer on the stack. Thus the actual release function (when required) will be called only at the end of the function. Fixes: 0511575c4d03 ("batman-adv: remove obsolete deleted attribute for gateway node") Signed-off-by: Sven Eckelmann --- net/batman-adv/gateway_client.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c index 8350775..c9b8b48 100644 --- a/net/batman-adv/gateway_client.c +++ b/net/batman-adv/gateway_client.c @@ -527,11 +527,12 @@ void batadv_gw_node_update(struct batadv_priv *bat_priv, * gets dereferenced. */ spin_lock_bh(&bat_priv->gw.list_lock); - hlist_del_init_rcu(&gw_node->list); + if (!hlist_unhashed(&gw_node->list)) { + hlist_del_init_rcu(&gw_node->list); + batadv_gw_node_free_ref(gw_node); + } spin_unlock_bh(&bat_priv->gw.list_lock); - batadv_gw_node_free_ref(gw_node); - curr_gw = batadv_gw_get_selected_gw_node(bat_priv); if (gw_node == curr_gw) batadv_gw_reselect(bat_priv);