batman-adv: protect tt request from double deletion

The list_del() calls were changed to list_del_init() to prevent
an accidental double deletion in batadv_tt_req_node_new().

Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>

diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 1573489c1f8a49a2a513c5758608d74f074a6920..cd35bb846582a90fcce035cc6ff62055a76a1605 100644 (file)
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -2196,7 +2196,7 @@ static void batadv_tt_req_list_free(struct batadv_priv *bat_priv)
        spin_lock_bh(&bat_priv->tt.req_list_lock);
 
        list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
-               list_del(&node->list);
+               list_del_init(&node->list);
                kfree(node);
        }
 
@@ -2232,7 +2232,7 @@ static void batadv_tt_req_purge(struct batadv_priv *bat_priv)
        list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
                if (batadv_has_timed_out(node->issued_at,
                                         BATADV_TT_REQUEST_TIMEOUT)) {
-                       list_del(&node->list);
+                       list_del_init(&node->list);
                        kfree(node);
                }
        }
@@ -2514,7 +2514,8 @@ out:
                batadv_hardif_free_ref(primary_if);
        if (ret && tt_req_node) {
                spin_lock_bh(&bat_priv->tt.req_list_lock);
-               list_del(&tt_req_node->list);
+               /* list_del_init() verifies tt_req_node still is in the list */
+               list_del_init(&tt_req_node->list);
                spin_unlock_bh(&bat_priv->tt.req_list_lock);
                kfree(tt_req_node);
        }
@@ -2951,7 +2952,7 @@ static void batadv_handle_tt_response(struct batadv_priv *bat_priv,
        list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
                if (!batadv_compare_eth(node->addr, resp_src))
                        continue;
-               list_del(&node->list);
+               list_del_init(&node->list);
                kfree(node);
        }