lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ipcomp: Avoid duplicate calls to ipcomp_destroy

Browse Source 
When ipcomp_tunnel_attach fails we will call ipcomp_destroy twice.
This may lead to double-frees on certain structures.

As there is no reason to explicitly call ipcomp_destroy, this patch
removes it from ipcomp*.c and lets the standard xfrm_state destruction
take place.

This is based on the discovery and patch by Alexey Dobriyan.

Tested-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Herbert Xu
2010-02-15 19:24:30 +00:00
committed by David S. Miller
parent 1cab819b5e
commit 10e7454ed7
2 changed files with 2 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
net/ipv4/ipcomp.c
View File

@@ -124,16 +124,12 @@ static int ipcomp4_init_state(struct xfrm_state *x)
if (x->props.mode == XFRM_MODE_TUNNEL) { if (x->props.mode == XFRM_MODE_TUNNEL) {
err = ipcomp_tunnel_attach(x); err = ipcomp_tunnel_attach(x);
if (err) if (err)
goto error_tunnel; goto out;
} }
err = 0; err = 0;
out: out:
return err; return err;
error_tunnel:
ipcomp_destroy(x);
goto out;
} }
static const struct xfrm_type ipcomp_type = { static const struct xfrm_type ipcomp_type = {

6
net/ipv6/ipcomp6.c
View File

@@ -154,16 +154,12 @@ static int ipcomp6_init_state(struct xfrm_state *x)
if (x->props.mode == XFRM_MODE_TUNNEL) { if (x->props.mode == XFRM_MODE_TUNNEL) {
err = ipcomp6_tunnel_attach(x); err = ipcomp6_tunnel_attach(x);
if (err) if (err)
goto error_tunnel; goto out;
} }
err = 0; err = 0;
out: out:
return err; return err;
error_tunnel:
ipcomp_destroy(x);
goto out;
} }
static const struct xfrm_type ipcomp6_type = static const struct xfrm_type ipcomp6_type =