summaryrefslogtreecommitdiff
path: root/net/batman-adv
diff options
context:
space:
mode:
authorMarek Lindner <mareklindner@neomailbox.ch>2015-06-21 19:30:23 +0300
committerAntonio Quartulli <antonio@meshcoding.com>2015-08-25 01:12:21 +0300
commita121048a89f8186fa2c8388d5b41528466013857 (patch)
treef26005872c6fb6ab97f6f482de9e2b8e749aca7f /net/batman-adv
parentd0fa4f3f5b0419a016ff27eea2fa615e4c0d1713 (diff)
downloadlinux-a121048a89f8186fa2c8388d5b41528466013857.tar.xz
batman-adv: prevent potential hlist double deletion
The hlist_del_rcu() call in batadv_tt_global_size_mod() does not check if the element still is part of the list prior to deletion. The atomic list counter should prevent the worst but converting to hlist_del_init_rcu() ensures the element can't be deleted more than once. Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch> Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>
Diffstat (limited to 'net/batman-adv')
-rw-r--r--net/batman-adv/translation-table.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 9e1f866a59f4..596e326b01d0 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -315,7 +315,7 @@ static void batadv_tt_global_size_mod(struct batadv_orig_node *orig_node,
if (atomic_add_return(v, &vlan->tt.num_entries) == 0) {
spin_lock_bh(&orig_node->vlan_list_lock);
- hlist_del_rcu(&vlan->list);
+ hlist_del_init_rcu(&vlan->list);
spin_unlock_bh(&orig_node->vlan_list_lock);
batadv_orig_node_vlan_free_ref(vlan);
}