diff options
| author | Sven Eckelmann <sven@narfation.org> | 2016-06-30 20:10:46 +0200 |
|---|---|---|
| committer | Simon Wunderlich <sw@simonwunderlich.de> | 2016-07-05 12:43:10 +0200 |
| commit | 33fbb1f3db87ce53da925b3e034b4dd446d483f8 (patch) | |
| tree | 36deda9a7b286a773b9cca3314d533a36a9dbe9f /net/batman-adv | |
| parent | batman-adv: Avoid nullptr dereference in dat after vlan_insert_tag (diff) | |
| download | linux-33fbb1f3db87ce53da925b3e034b4dd446d483f8.tar.xz linux-33fbb1f3db87ce53da925b3e034b4dd446d483f8.zip | |
batman-adv: Fix orig_node_vlan leak on orig_node_release
batadv_orig_node_new uses batadv_orig_node_vlan_new to allocate a new
batadv_orig_node_vlan and add it to batadv_orig_node::vlan_list. References
to this list have also to be cleaned when the batadv_orig_node is removed.
Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Diffstat (limited to 'net/batman-adv')
| -rw-r--r-- | net/batman-adv/originator.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c index 7f51bc2c06eb..fe2fcda4a984 100644 --- a/net/batman-adv/originator.c +++ b/net/batman-adv/originator.c @@ -765,6 +765,7 @@ static void batadv_orig_node_release(struct kref *ref) struct batadv_neigh_node *neigh_node; struct batadv_orig_node *orig_node; struct batadv_orig_ifinfo *orig_ifinfo; + struct batadv_orig_node_vlan *vlan; orig_node = container_of(ref, struct batadv_orig_node, refcount); @@ -784,6 +785,13 @@ static void batadv_orig_node_release(struct kref *ref) } spin_unlock_bh(&orig_node->neigh_list_lock); + spin_lock_bh(&orig_node->vlan_list_lock); + hlist_for_each_entry_safe(vlan, node_tmp, &orig_node->vlan_list, list) { + hlist_del_rcu(&vlan->list); + batadv_orig_node_vlan_put(vlan); + } + spin_unlock_bh(&orig_node->vlan_list_lock); + /* Free nc_nodes */ batadv_nc_purge_orig(orig_node->bat_priv, orig_node, NULL); |