batman-adv/patches/0011-batman-adv-protect-tt-request-from-double-deletion.patch

   1 From 9bac35c1e4fab662522371f81147963e19693409 Mon Sep 17 00:00:00 2001
   2 From: Marek Lindner <mareklindner@neomailbox.ch>
   3 Date: Mon, 22 Jun 2015 00:36:28 +0800
   4 Subject: [PATCH 11/13] batman-adv: protect tt request from double deletion
   5
   6 The list_del() calls were changed to list_del_init() to prevent
   7 an accidental double deletion in batadv_tt_req_node_new().
   8
   9 Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
  10 Acked-by: Antonio Quartulli <antonio@meshcoding.com>
  11 ---
  12  translation-table.c | 9 +++++----
  13  1 file changed, 5 insertions(+), 4 deletions(-)
  14
  15 diff --git a/translation-table.c b/translation-table.c
  16 index dfe8896..b6c0f52 100644
  17 --- a/translation-table.c
  18 +++ b/translation-table.c
  19 @@ -2194,7 +2194,7 @@ static void batadv_tt_req_list_free(struct batadv_priv *bat_priv)
  20         spin_lock_bh(&bat_priv->tt.req_list_lock);
  21
  22         list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
  23 -               list_del(&node->list);
  24 +               list_del_init(&node->list);
  25                 kfree(node);
  26         }
  27
  28 @@ -2230,7 +2230,7 @@ static void batadv_tt_req_purge(struct batadv_priv *bat_priv)
  29         list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
  30                 if (batadv_has_timed_out(node->issued_at,
  31                                          BATADV_TT_REQUEST_TIMEOUT)) {
  32 -                       list_del(&node->list);
  33 +                       list_del_init(&node->list);
  34                         kfree(node);
  35                 }
  36         }
  37 @@ -2512,7 +2512,8 @@ out:
  38                 batadv_hardif_free_ref(primary_if);
  39         if (ret && tt_req_node) {
  40                 spin_lock_bh(&bat_priv->tt.req_list_lock);
  41 -               list_del(&tt_req_node->list);
  42 +               /* list_del_init() verifies tt_req_node still is in the list */
  43 +               list_del_init(&tt_req_node->list);
  44                 spin_unlock_bh(&bat_priv->tt.req_list_lock);
  45                 kfree(tt_req_node);
  46         }
  47 @@ -2949,7 +2950,7 @@ static void batadv_handle_tt_response(struct batadv_priv *bat_priv,
  48         list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
  49                 if (!batadv_compare_eth(node->addr, resp_src))
  50                         continue;
  51 -               list_del(&node->list);
  52 +               list_del_init(&node->list);
  53                 kfree(node);
  54         }
  55
  56 --
  57 2.1.4
  58