On Saturday, August 6, 2016 3:50:52 PM HKT Sven Eckelmann wrote:
> batadv_find_router dereferences last_bonding_candidate from
> orig_node without making sure that it has a valid reference. This reference
> has to be retrieved by increasing the reference counter while holding
> neigh_list_lock. The lock is required to avoid that
> batadv_last_bonding_replace removes the current last_bonding_candidate,
> reduces the reference counter and maybe destroys the object in this
> process.
> 
> Fixes: 797edd9e87ac ("batman-adv: add bonding again")
> Signed-off-by: Sven Eckelmann <sven@narfation.org>
> ---
> This patch was only build tested.
> ---
>  net/batman-adv/routing.c | 28 +++++++++++++++++++++++++++-
>  1 file changed, 27 insertions(+), 1 deletion(-)

Applied in revision 008afae.

Thanks,
Marek