hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

batman-adv: protect tt request from double deletion 

The list_del() calls were changed to list_del_init() to prevent
an accidental double deletion in batadv_tt_req_node_new().

Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>
This commit is contained in:
Marek Lindner 2015-06-22 00:36:28 +08:00 committed by Antonio Quartulli
parent 8a4023c5b5
commit 1f15510164
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
net/batman-adv/translation-table.c
View File

@ -2196,7 +2196,7 @@ static void batadv_tt_req_list_free(struct batadv_priv *bat_priv)
spin_lock_bh(&bat_priv->tt.req_list_lock); spin_lock_bh(&bat_priv->tt.req_list_lock);
list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) { list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
list_del(&node->list); list_del_init(&node->list);
kfree(node); kfree(node);
} }
@ -2232,7 +2232,7 @@ static void batadv_tt_req_purge(struct batadv_priv *bat_priv)
list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) { list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
if (batadv_has_timed_out(node->issued_at, if (batadv_has_timed_out(node->issued_at,
BATADV_TT_REQUEST_TIMEOUT)) { BATADV_TT_REQUEST_TIMEOUT)) {
list_del(&node->list); list_del_init(&node->list);
kfree(node); kfree(node);
} }
} }
@ -2514,7 +2514,8 @@ out:
batadv_hardif_free_ref(primary_if); batadv_hardif_free_ref(primary_if);
if (ret && tt_req_node) { if (ret && tt_req_node) {
spin_lock_bh(&bat_priv->tt.req_list_lock); spin_lock_bh(&bat_priv->tt.req_list_lock);
list_del(&tt_req_node->list); /* list_del_init() verifies tt_req_node still is in the list */
list_del_init(&tt_req_node->list);
spin_unlock_bh(&bat_priv->tt.req_list_lock); spin_unlock_bh(&bat_priv->tt.req_list_lock);
kfree(tt_req_node); kfree(tt_req_node);
} }
@ -2951,7 +2952,7 @@ static void batadv_handle_tt_response(struct batadv_priv *bat_priv,
list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) { list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
if (!batadv_compare_eth(node->addr, resp_src)) if (!batadv_compare_eth(node->addr, resp_src))
continue; continue;
list_del(&node->list); list_del_init(&node->list);
kfree(node); kfree(node);
} }