diff options
| author | Marek Lindner <mareklindner@neomailbox.ch> | 2015-06-22 00:30:23 +0800 |
|---|---|---|
| committer | Antonio Quartulli <antonio@meshcoding.com> | 2015-08-25 00:12:21 +0200 |
| commit | a121048a89f8186fa2c8388d5b41528466013857 (patch) | |
| tree | f26005872c6fb6ab97f6f482de9e2b8e749aca7f /net/batman-adv | |
| parent | d0fa4f3f5b0419a016ff27eea2fa615e4c0d1713 (diff) | |
| download | op-kernel-dev-a121048a89f8186fa2c8388d5b41528466013857.zip op-kernel-dev-a121048a89f8186fa2c8388d5b41528466013857.tar.gz | |
batman-adv: prevent potential hlist double deletion
The hlist_del_rcu() call in batadv_tt_global_size_mod() does not check
if the element still is part of the list prior to deletion. The atomic
list counter should prevent the worst but converting to
hlist_del_init_rcu() ensures the element can't be deleted more than
once.
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>
Diffstat (limited to 'net/batman-adv')
| -rw-r--r-- | net/batman-adv/translation-table.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index 9e1f866..596e326 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -315,7 +315,7 @@ static void batadv_tt_global_size_mod(struct batadv_orig_node *orig_node, if (atomic_add_return(v, &vlan->tt.num_entries) == 0) { spin_lock_bh(&orig_node->vlan_list_lock); - hlist_del_rcu(&vlan->list); + hlist_del_init_rcu(&vlan->list); spin_unlock_bh(&orig_node->vlan_list_lock); batadv_orig_node_vlan_free_ref(vlan); } |
