leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

batman-adv: prevent potential hlist double deletion

Browse Source 
The hlist_del_rcu() call in batadv_tt_global_size_mod() does not check
if the element still is part of the list prior to deletion. The atomic
list counter should prevent the worst but converting to
hlist_del_init_rcu() ensures the element can't be deleted more than
once.

Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>
This commit is contained in:
Marek Lindner 2015-06-22 00:30:23 +08:00 committed by Antonio Quartulli
parent d0fa4f3f5b
commit a121048a89
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
net/batman-adv/translation-table.c
View File

@ -315,7 +315,7 @@ static void batadv_tt_global_size_mod(struct batadv_orig_node *orig_node,
if (atomic_add_return(v, &vlan->tt.num_entries) == 0) { if (atomic_add_return(v, &vlan->tt.num_entries) == 0) {
spin_lock_bh(&orig_node->vlan_list_lock); spin_lock_bh(&orig_node->vlan_list_lock);
hlist_del_rcu(&vlan->list); hlist_del_init_rcu(&vlan->list);
spin_unlock_bh(&orig_node->vlan_list_lock); spin_unlock_bh(&orig_node->vlan_list_lock);
batadv_orig_node_vlan_free_ref(vlan); batadv_orig_node_vlan_free_ref(vlan);
} }