3.16.62-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Sven Eckelmann <sven@xxxxxxxxxxxxx> commit 0de32ceee156787429035c974316f4e5098cf722 upstream. batadv_nc_get_nc_node requires that the caller already has a valid reference for orig_neigh_node. It is therefore not possible that it has an reference counter of 0 and was still given to this function The kref_get function instead WARNs (with debug information) when the reference counter would still be 0. This makes a bug in batman-adv better visible because kref_get_unless_zero would have ignored this problem. Signed-off-by: Sven Eckelmann <sven@xxxxxxxxxxxxx> Signed-off-by: Marek Lindner <mareklindner@xxxxxxxxxxxxx> Signed-off-by: Antonio Quartulli <a@xxxxxxxxxxx> [bwh: Backported to 3.16: Reference counts are not krefs here, so open- code the equivalent of kref_get()] Signed-off-by: Ben Hutchings <ben@xxxxxxxxxxxxxxx> --- net/batman-adv/network-coding.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) --- a/net/batman-adv/network-coding.c +++ b/net/batman-adv/network-coding.c @@ -813,8 +813,7 @@ static struct batadv_nc_node if (!nc_node) return NULL; - if (!atomic_inc_not_zero(&orig_neigh_node->refcount)) - goto free; + WARN_ON_ONCE(atomic_inc_return(&orig_neigh_node->refcount) < 2); /* Initialize nc_node */ INIT_LIST_HEAD(&nc_node->list); @@ -840,10 +839,6 @@ static struct batadv_nc_node spin_unlock_bh(lock); return nc_node; - -free: - kfree(nc_node); - return NULL; } /**
