batman-adv: protect tt request from double deletion
The list_del() calls were changed to list_del_init() to prevent an accidental double deletion in batadv_tt_req_node_new(). Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch> Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>
This commit is contained in:
parent
8a4023c5b5
commit
1f15510164
|
@ -2196,7 +2196,7 @@ static void batadv_tt_req_list_free(struct batadv_priv *bat_priv)
|
||||||
spin_lock_bh(&bat_priv->tt.req_list_lock);
|
spin_lock_bh(&bat_priv->tt.req_list_lock);
|
||||||
|
|
||||||
list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
|
list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
|
||||||
list_del(&node->list);
|
list_del_init(&node->list);
|
||||||
kfree(node);
|
kfree(node);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -2232,7 +2232,7 @@ static void batadv_tt_req_purge(struct batadv_priv *bat_priv)
|
||||||
list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
|
list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
|
||||||
if (batadv_has_timed_out(node->issued_at,
|
if (batadv_has_timed_out(node->issued_at,
|
||||||
BATADV_TT_REQUEST_TIMEOUT)) {
|
BATADV_TT_REQUEST_TIMEOUT)) {
|
||||||
list_del(&node->list);
|
list_del_init(&node->list);
|
||||||
kfree(node);
|
kfree(node);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -2514,7 +2514,8 @@ out:
|
||||||
batadv_hardif_free_ref(primary_if);
|
batadv_hardif_free_ref(primary_if);
|
||||||
if (ret && tt_req_node) {
|
if (ret && tt_req_node) {
|
||||||
spin_lock_bh(&bat_priv->tt.req_list_lock);
|
spin_lock_bh(&bat_priv->tt.req_list_lock);
|
||||||
list_del(&tt_req_node->list);
|
/* list_del_init() verifies tt_req_node still is in the list */
|
||||||
|
list_del_init(&tt_req_node->list);
|
||||||
spin_unlock_bh(&bat_priv->tt.req_list_lock);
|
spin_unlock_bh(&bat_priv->tt.req_list_lock);
|
||||||
kfree(tt_req_node);
|
kfree(tt_req_node);
|
||||||
}
|
}
|
||||||
|
@ -2951,7 +2952,7 @@ static void batadv_handle_tt_response(struct batadv_priv *bat_priv,
|
||||||
list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
|
list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
|
||||||
if (!batadv_compare_eth(node->addr, resp_src))
|
if (!batadv_compare_eth(node->addr, resp_src))
|
||||||
continue;
|
continue;
|
||||||
list_del(&node->list);
|
list_del_init(&node->list);
|
||||||
kfree(node);
|
kfree(node);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue