diff options
| author | David S. Miller <davem@davemloft.net> | 2016-02-19 15:35:29 -0500 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2016-02-19 15:35:29 -0500 |
| commit | 29d1441dfc737c9422db02e4c95eb4ea0035effd (patch) | |
| tree | bb5f399ace8b88fb1e90022f5345366461859eb4 /net/batman-adv/translation-table.c | |
| parent | a97eb33ff225f34a8124774b3373fd244f0e83ce (diff) | |
| parent | 1bc4e2b000e7fa9773d6623bc8850561ce10a4fb (diff) | |
| download | linux-sh-29d1441dfc737c9422db02e4c95eb4ea0035effd.tar.gz | |
Merge tag 'batman-adv-fix-for-davem' of git://git.open-mesh.org/linux-merge
Antonio Quartulli says:
====================
Two of the fixes included in this patchset prevent wrong memory
access - it was triggered when removing an object from a list
after it was already free'd due to bad reference counting.
This misbehaviour existed for both the gw_node and the
orig_node_vlan object and has been fixed by Sven Eckelmann.
The last patch fixes our interface feasibility check and prevents
it from looping indefinitely when two net_device objects
reference each other via iflink index (i.e. veth pair), by
Andrew Lunn
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/batman-adv/translation-table.c')
| -rw-r--r-- | net/batman-adv/translation-table.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index cdfc85fa2743..0e80fd1461ab 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -303,9 +303,11 @@ static void batadv_tt_global_size_mod(struct batadv_orig_node *orig_node, if (atomic_add_return(v, &vlan->tt.num_entries) == 0) { spin_lock_bh(&orig_node->vlan_list_lock); - hlist_del_init_rcu(&vlan->list); + if (!hlist_unhashed(&vlan->list)) { + hlist_del_init_rcu(&vlan->list); + batadv_orig_node_vlan_free_ref(vlan); + } spin_unlock_bh(&orig_node->vlan_list_lock); - batadv_orig_node_vlan_free_ref(vlan); } batadv_orig_node_vlan_free_ref(vlan); |