In batadv_interface_kill_vid(), batadv_meshif_vlan_get() acquires a reference on the vlan object. batadv_meshif_destroy_vlan() internally calls batadv_meshif_vlan_put() which balances that reference. However, an additional batadv_meshif_vlan_put(vlan) is called after batadv_meshif_destroy_vlan(), causing a refcount underflow and potential use-after-free of the vlan object.
Remove the extra batadv_meshif_vlan_put(vlan) call. Cc: [email protected] Fixes: 5d2c05b21337 ("batman-adv: add per VLAN interface attribute framework") Signed-off-by: WenTao Liang <[email protected]> --- net/batman-adv/mesh-interface.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/net/batman-adv/mesh-interface.c b/net/batman-adv/mesh-interface.c index e7aa45bc6b7a..cc974f243200 100644 --- a/net/batman-adv/mesh-interface.c +++ b/net/batman-adv/mesh-interface.c @@ -691,9 +691,6 @@ static int batadv_interface_kill_vid(struct net_device *dev, __be16 proto, batadv_meshif_destroy_vlan(bat_priv, vlan); - /* finally free the vlan object */ - batadv_meshif_vlan_put(vlan); - return 0; } -- 2.39.5 (Apple Git-154)
