summaryrefslogtreecommitdiff
path: root/net/batman-adv/gateway_client.c
diff options
context:
space:
mode:
authorDavid S. Miller <davem@davemloft.net>2016-02-19 15:35:29 -0500
committerDavid S. Miller <davem@davemloft.net>2016-02-19 15:35:29 -0500
commit29d1441dfc737c9422db02e4c95eb4ea0035effd (patch)
treebb5f399ace8b88fb1e90022f5345366461859eb4 /net/batman-adv/gateway_client.c
parenta97eb33ff225f34a8124774b3373fd244f0e83ce (diff)
parent1bc4e2b000e7fa9773d6623bc8850561ce10a4fb (diff)
downloadlinux-sh-29d1441dfc737c9422db02e4c95eb4ea0035effd.tar.gz
Merge tag 'batman-adv-fix-for-davem' of git://git.open-mesh.org/linux-merge
Antonio Quartulli says: ==================== Two of the fixes included in this patchset prevent wrong memory access - it was triggered when removing an object from a list after it was already free'd due to bad reference counting. This misbehaviour existed for both the gw_node and the orig_node_vlan object and has been fixed by Sven Eckelmann. The last patch fixes our interface feasibility check and prevents it from looping indefinitely when two net_device objects reference each other via iflink index (i.e. veth pair), by Andrew Lunn ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/batman-adv/gateway_client.c')
-rw-r--r--net/batman-adv/gateway_client.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
index e6c8382c79ba..ccf70bed0d0c 100644
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -527,11 +527,12 @@ void batadv_gw_node_update(struct batadv_priv *bat_priv,
* gets dereferenced.
*/
spin_lock_bh(&bat_priv->gw.list_lock);
- hlist_del_init_rcu(&gw_node->list);
+ if (!hlist_unhashed(&gw_node->list)) {
+ hlist_del_init_rcu(&gw_node->list);
+ batadv_gw_node_free_ref(gw_node);
+ }
spin_unlock_bh(&bat_priv->gw.list_lock);
- batadv_gw_node_free_ref(gw_node);
-
curr_gw = batadv_gw_get_selected_gw_node(bat_priv);
if (gw_node == curr_gw)
batadv_gw_reselect(bat_priv);