From patchwork Sun Jan 31 12:28:00 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sven Eckelmann X-Patchwork-Id: 5080 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=79.140.41.39; helo=v3-1039.vlinux.de; envelope-from=sven@narfation.org; receiver=b.a.t.m.a.n@lists.open-mesh.org Authentication-Results: open-mesh.org; dmarc=pass header.from=narfation.org Authentication-Results: open-mesh.org; dkim=pass reason="1024-bit key; unprotected key" header.d=narfation.org header.i=@narfation.org header.b=PY3lXC+J; dkim-adsp=pass; dkim-atps=neutral Received: from v3-1039.vlinux.de (narfation.org [79.140.41.39]) by open-mesh.org (Postfix) with ESMTPS id 181FB81CAE for ; Sun, 31 Jan 2016 13:28:14 +0100 (CET) Received: from sven-desktop.home.narfation.org (p200300C593C398FD0000000000002E16.dip0.t-ipconnect.de [IPv6:2003:c5:93c3:98fd::2e16]) by v3-1039.vlinux.de (Postfix) with ESMTPSA id 8AE611100E7; Sun, 31 Jan 2016 13:28:13 +0100 (CET) Authentication-Results: v3-1039.vlinux.de; dmarc=none header.from=narfation.org DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=narfation.org; s=20121; t=1454243293; bh=Sy0/epa51riX7KwL0s1RD831hTC3RkZrOpjVQ9KFUnE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PY3lXC+JunkxJpbabu0I3E6i9C7+TZLBYNa8YNVTlgH1yr4Ke9aMPwmDgQYrBPgTf ceSpqLQ8F6fYIeCdkq6PrJrJzWSD4crmwexmx6VvTJxMUJrS6HoLcu2gSv3VWRbQqj oRqvI56rYRfBj8v6wSK+yZV2FasRJV78FU7e4QdM= From: Sven Eckelmann To: b.a.t.m.a.n@lists.open-mesh.org Date: Sun, 31 Jan 2016 13:28:00 +0100 Message-Id: <1454243280-15126-2-git-send-email-sven@narfation.org> X-Mailer: git-send-email 2.7.0 In-Reply-To: <1454243280-15126-1-git-send-email-sven@narfation.org> References: <1454243280-15126-1-git-send-email-sven@narfation.org> Subject: [B.A.T.M.A.N.] [PATCH-maint 2/2] batman-adv: Only put orig_node_vlan list reference when removed X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 31 Jan 2016 12:28:14 -0000 The batadv_orig_node_vlan reference counter in batadv_tt_global_size_mod can only be reduced when the list entry was actually removed. Otherwise the reference counter may reach zero when batadv_tt_global_size_mod is called from two different contexts for the same orig_node_vlan but only one context is actually removing the entry from the list. The release function for this orig_node_vlan is not called inside the vlan_list_lock spinlock protected region because the function batadv_tt_global_size_mod still holds a orig_node_vlan reference for the object pointer on the stack. Thus the actual release function (when required) will be called only at the end of the function. Fixes: 21a57f6e7a3b ("batman-adv: make the TT CRC logic VLAN specific") Signed-off-by: Sven Eckelmann --- net/batman-adv/translation-table.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index 9fcf6bf..7301a92 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -311,9 +311,11 @@ static void batadv_tt_global_size_mod(struct batadv_orig_node *orig_node, if (atomic_add_return(v, &vlan->tt.num_entries) == 0) { spin_lock_bh(&orig_node->vlan_list_lock); - hlist_del_init_rcu(&vlan->list); + if (!hlist_unhashed(&vlan->list)) { + hlist_del_init_rcu(&vlan->list); + batadv_orig_node_vlan_free_ref(vlan); + } spin_unlock_bh(&orig_node->vlan_list_lock); - batadv_orig_node_vlan_free_ref(vlan); } batadv_orig_node_vlan_free_ref(vlan);