summaryrefslogtreecommitdiffstats
path: root/net/batman-adv
diff options
context:
space:
mode:
authorMarek Lindner <mareklindner@neomailbox.ch>2015-06-22 00:36:28 +0800
committerAntonio Quartulli <antonio@meshcoding.com>2015-08-14 22:52:09 +0200
commit1f155101646e6f6cda218534ff6e252ff625137b (patch)
tree5a2186c2125657c96fa4a682ecf24080d9696395 /net/batman-adv
parent8a4023c5b5e30b11f1f383186f4a7222b3b823cf (diff)
downloadlinux-1f155101646e6f6cda218534ff6e252ff625137b.tar.bz2
batman-adv: protect tt request from double deletion
The list_del() calls were changed to list_del_init() to prevent an accidental double deletion in batadv_tt_req_node_new(). Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch> Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>
Diffstat (limited to 'net/batman-adv')
-rw-r--r--net/batman-adv/translation-table.c9
1 files changed, 5 insertions, 4 deletions
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 1573489c1f8a..cd35bb846582 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -2196,7 +2196,7 @@ static void batadv_tt_req_list_free(struct batadv_priv *bat_priv)
spin_lock_bh(&bat_priv->tt.req_list_lock);
list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
- list_del(&node->list);
+ list_del_init(&node->list);
kfree(node);
}
@@ -2232,7 +2232,7 @@ static void batadv_tt_req_purge(struct batadv_priv *bat_priv)
list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
if (batadv_has_timed_out(node->issued_at,
BATADV_TT_REQUEST_TIMEOUT)) {
- list_del(&node->list);
+ list_del_init(&node->list);
kfree(node);
}
}
@@ -2514,7 +2514,8 @@ out:
batadv_hardif_free_ref(primary_if);
if (ret && tt_req_node) {
spin_lock_bh(&bat_priv->tt.req_list_lock);
- list_del(&tt_req_node->list);
+ /* list_del_init() verifies tt_req_node still is in the list */
+ list_del_init(&tt_req_node->list);
spin_unlock_bh(&bat_priv->tt.req_list_lock);
kfree(tt_req_node);
}
@@ -2951,7 +2952,7 @@ static void batadv_handle_tt_response(struct batadv_priv *bat_priv,
list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
if (!batadv_compare_eth(node->addr, resp_src))
continue;
- list_del(&node->list);
+ list_del_init(&node->list);
kfree(node);
}