batman-adv/patches/0003-batman-adv-Avoid-tt_req_node-list-put-for-unhashed-e.patch

   1 From: Sven Eckelmann <sven@narfation.org>
   2 Date: Fri, 24 Jun 2016 21:43:32 +0200
   3 Subject: [PATCH] batman-adv: Avoid tt_req_node list put for unhashed entry
   4
   5 It can happen that a tt_req_node list entry was already removed from
   6 tt.req_list when batadv_send_tt_request reaches the end of the function.
   7 The reference counter was already reduced by 1 for the list entry and thus
   8 the reference counter is not allowed to be reduced again. Otherwise, the
   9 entry is freed too early and the next batadv_tt_req_node_put in this
  10 function will operate on freed memory.
  11
  12 Fixes: cea194d90b11 ("batman-adv: improved client announcement mechanism")
  13 Signed-off-by: Sven Eckelmann <sven@narfation.org>
  14 Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
  15
  16 Origin: upstream, https://git.open-mesh.org/batman-adv.git/commit/03ecc9f957b837c755f09251c5f684996521e487
  17 ---
  18  net/batman-adv/translation-table.c | 8 +++++---
  19  1 file changed, 5 insertions(+), 3 deletions(-)
  20
  21 diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
  22 index d033a05..57ec87f 100644
  23 --- a/net/batman-adv/translation-table.c
  24 +++ b/net/batman-adv/translation-table.c
  25 @@ -2639,11 +2639,13 @@ static bool batadv_send_tt_request(struct batadv_priv *bat_priv,
  26  out:
  27         if (primary_if)
  28                 batadv_hardif_put(primary_if);
  29 +
  30         if (ret && tt_req_node) {
  31                 spin_lock_bh(&bat_priv->tt.req_list_lock);
  32 -               /* hlist_del_init() verifies tt_req_node still is in the list */
  33 -               hlist_del_init(&tt_req_node->list);
  34 -               batadv_tt_req_node_put(tt_req_node);
  35 +               if (!hlist_unhashed(&tt_req_node->list)) {
  36 +                       hlist_del_init(&tt_req_node->list);
  37 +                       batadv_tt_req_node_put(tt_req_node);
  38 +               }
  39                 spin_unlock_bh(&bat_priv->tt.req_list_lock);
  40         }
  41