From: Marek Lindner Date: Sun, 21 Jun 2015 16:30:23 +0000 (+0800) Subject: batman-adv: prevent potential hlist double deletion X-Git-Tag: v5.15~15163^2~82^2~7 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=a121048a89f8186fa2c8388d5b41528466013857;p=platform%2Fkernel%2Flinux-starfive.git batman-adv: prevent potential hlist double deletion The hlist_del_rcu() call in batadv_tt_global_size_mod() does not check if the element still is part of the list prior to deletion. The atomic list counter should prevent the worst but converting to hlist_del_init_rcu() ensures the element can't be deleted more than once. Signed-off-by: Marek Lindner Signed-off-by: Antonio Quartulli --- diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index 9e1f866..596e326 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -315,7 +315,7 @@ static void batadv_tt_global_size_mod(struct batadv_orig_node *orig_node, if (atomic_add_return(v, &vlan->tt.num_entries) == 0) { spin_lock_bh(&orig_node->vlan_list_lock); - hlist_del_rcu(&vlan->list); + hlist_del_init_rcu(&vlan->list); spin_unlock_bh(&orig_node->vlan_list_lock); batadv_orig_node_vlan_free_ref(vlan); }