X-Git-Url: http://plrg.eecs.uci.edu/git/?a=blobdiff_plain;f=net%2Fbatman-adv%2Frouting.c;h=d8a2f33e60e552dcd6a33aa385f03e3bbfa5e278;hb=25f584e0482caaed0e6d3cd86f899fcb89232b73;hp=3207667e69de30e92499c705f39319c55f36732f;hpb=44d8a7d5c1b4f9e99c5601217ce03a48412f9aac;p=firefly-linux-kernel-4.4.55.git

diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 3207667e69de..d8a2f33e60e5 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -104,6 +104,15 @@ static void _batadv_update_route(struct batadv_priv *bat_priv,
 		neigh_node = NULL;
 
 	spin_lock_bh(&orig_node->neigh_list_lock);
+	/* curr_router used earlier may not be the current orig_ifinfo->router
+	 * anymore because it was dereferenced outside of the neigh_list_lock
+	 * protected region. After the new best neighbor has replace the current
+	 * best neighbor the reference counter needs to decrease. Consequently,
+	 * the code needs to ensure the curr_router variable contains a pointer
+	 * to the replaced best neighbor.
+	 */
+	curr_router = rcu_dereference_protected(orig_ifinfo->router, true);
+
 	rcu_assign_pointer(orig_ifinfo->router, neigh_node);
 	spin_unlock_bh(&orig_node->neigh_list_lock);
 	batadv_orig_ifinfo_free_ref(orig_ifinfo);