mirror of
https://git.openwrt.org/feed/routing.git
synced 2024-06-20 23:58:28 +02:00
14e98d86ac
* Avoid nullptr dereference in bla after vlan_insert_tag * Avoid nullptr dereference in dat after vlan_insert_tag * Avoid tt_req_node list put for unhashed entry * Fix orig_node_vlan leak on orig_node_release * Fix non-atomic bla_claim::backbone_gw access * Fix reference leak in batadv_find_router * Free last_bonding_candidate on release of orig_node Signed-off-by: Sven Eckelmann <sven.eckelmann@open-mesh.com>
42 lines
1.7 KiB
Diff
42 lines
1.7 KiB
Diff
From: Sven Eckelmann <sven@narfation.org>
|
|
Date: Fri, 24 Jun 2016 21:43:32 +0200
|
|
Subject: [PATCH] batman-adv: Avoid tt_req_node list put for unhashed entry
|
|
|
|
It can happen that a tt_req_node list entry was already removed from
|
|
tt.req_list when batadv_send_tt_request reaches the end of the function.
|
|
The reference counter was already reduced by 1 for the list entry and thus
|
|
the reference counter is not allowed to be reduced again. Otherwise, the
|
|
entry is freed too early and the next batadv_tt_req_node_put in this
|
|
function will operate on freed memory.
|
|
|
|
Fixes: cea194d90b11 ("batman-adv: improved client announcement mechanism")
|
|
Signed-off-by: Sven Eckelmann <sven@narfation.org>
|
|
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
|
|
|
|
Origin: upstream, https://git.open-mesh.org/batman-adv.git/commit/03ecc9f957b837c755f09251c5f684996521e487
|
|
---
|
|
net/batman-adv/translation-table.c | 8 +++++---
|
|
1 file changed, 5 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
|
|
index 23fb7ea..f7d44c6 100644
|
|
--- a/net/batman-adv/translation-table.c
|
|
+++ b/net/batman-adv/translation-table.c
|
|
@@ -2639,11 +2639,13 @@ static int batadv_send_tt_request(struct batadv_priv *bat_priv,
|
|
out:
|
|
if (primary_if)
|
|
batadv_hardif_put(primary_if);
|
|
+
|
|
if (ret && tt_req_node) {
|
|
spin_lock_bh(&bat_priv->tt.req_list_lock);
|
|
- /* hlist_del_init() verifies tt_req_node still is in the list */
|
|
- hlist_del_init(&tt_req_node->list);
|
|
- batadv_tt_req_node_put(tt_req_node);
|
|
+ if (!hlist_unhashed(&tt_req_node->list)) {
|
|
+ hlist_del_init(&tt_req_node->list);
|
|
+ batadv_tt_req_node_put(tt_req_node);
|
|
+ }
|
|
spin_unlock_bh(&bat_priv->tt.req_list_lock);
|
|
}
|
|
|