]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
batman-adv: bla: only purge non-released claims
authorSven Eckelmann <sven@narfation.org>
Wed, 6 May 2026 20:20:51 +0000 (22:20 +0200)
committerSven Eckelmann <sven@narfation.org>
Fri, 8 May 2026 12:28:56 +0000 (14:28 +0200)
commitcf6b604011591865ae39ac82de8978c1120d17af
tree025b0f78e45e5788e56c569bf308568cd8a6ba74
parent4ae1709a314060a196981b344610d023ea841e57
batman-adv: bla: only purge non-released claims

When batadv_bla_purge_claims() goes through the list of claims, it is only
traversing the hash list with an rcu_read_lock(). Due to a potential
parallel batadv_claim_put(), it can happen that it encounters a claim which
was actually in the process of being released+freed by
batadv_claim_release(). In this case, backbone_gw is set to NULL before the
delayed RCU kfree is started. Calling batadv_bla_claim_get_backbone_gw() is
then no longer allowed because it would cause a NULL-ptr derefence.

To avoid this, only claims with a valid reference counter must be purged.
All others are already taken care of.

Cc: stable@kernel.org
Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
net/batman-adv/bridge_loop_avoidance.c