From: Marek Lindner Date: Sun, 21 Jun 2015 16:30:23 +0000 (+0800) Subject: batman-adv: prevent potential hlist double deletion X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=a121048a89f8186fa2c8388d5b41528466013857;p=linux-beck.git batman-adv: prevent potential hlist double deletion The hlist_del_rcu() call in batadv_tt_global_size_mod() does not check if the element still is part of the list prior to deletion. The atomic list counter should prevent the worst but converting to hlist_del_init_rcu() ensures the element can't be deleted more than once. Signed-off-by: Marek Lindner Signed-off-by: Antonio Quartulli --- diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index 9e1f866a59f4..596e326b01d0 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -315,7 +315,7 @@ static void batadv_tt_global_size_mod(struct batadv_orig_node *orig_node, if (atomic_add_return(v, &vlan->tt.num_entries) == 0) { spin_lock_bh(&orig_node->vlan_list_lock); - hlist_del_rcu(&vlan->list); + hlist_del_init_rcu(&vlan->list); spin_unlock_bh(&orig_node->vlan_list_lock); batadv_orig_node_vlan_free_ref(vlan); }