Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1f155101 authored by Marek Lindner's avatar Marek Lindner Committed by Antonio Quartulli
Browse files

batman-adv: protect tt request from double deletion 



The list_del() calls were changed to list_del_init() to prevent
an accidental double deletion in batadv_tt_req_node_new().

Signed-off-by: default avatarMarek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: default avatarAntonio Quartulli <antonio@meshcoding.com>
parent 8a4023c5

net/batman-adv/translation-table.c

+5 −4
Original line number Diff line number Diff line
@@ -2196,7 +2196,7 @@ static void batadv_tt_req_list_free(struct batadv_priv *bat_priv) 
	spin_lock_bh(&bat_priv->tt.req_list_lock);



	list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {

		list_del(&node->list);

		list_del_init(&node->list);

		kfree(node);

	}
@@ -2232,7 +2232,7 @@ static void batadv_tt_req_purge(struct batadv_priv *bat_priv) 
	list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {

		if (batadv_has_timed_out(node->issued_at,

					 BATADV_TT_REQUEST_TIMEOUT)) {

			list_del(&node->list);

			list_del_init(&node->list);

			kfree(node);

		}

	}
@@ -2514,7 +2514,8 @@ static int batadv_send_tt_request(struct batadv_priv *bat_priv, 
		batadv_hardif_free_ref(primary_if);

	if (ret && tt_req_node) {

		spin_lock_bh(&bat_priv->tt.req_list_lock);

		list_del(&tt_req_node->list);

		/* list_del_init() verifies tt_req_node still is in the list */

		list_del_init(&tt_req_node->list);

		spin_unlock_bh(&bat_priv->tt.req_list_lock);

		kfree(tt_req_node);

	}
@@ -2951,7 +2952,7 @@ static void batadv_handle_tt_response(struct batadv_priv *bat_priv, 
	list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {

		if (!batadv_compare_eth(node->addr, resp_src))

			continue;

		list_del(&node->list);

		list_del_init(&node->list);

		kfree(node);

	}