Message ID | 20100216052430.GA27643@gondor.apana.org.au |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
From: Herbert Xu <herbert@gondor.apana.org.au> Date: Tue, 16 Feb 2010 13:24:30 +0800 > On Mon, Feb 15, 2010 at 07:28:10PM +0200, Alexey Dobriyan wrote: >> >> OK, it survives beating here. > > Thanks a lot for testing! I'll do the clean-up you suggested in > another patch. Let's get this fixed first. > > ipcomp: Avoid duplicate calls to ipcomp_destroy > > When ipcomp_tunnel_attach fails we will call ipcomp_destroy twice. > This may lead to double-frees on certain structures. > > As there is no reason to explicitly call ipcomp_destroy, this patch > removes it from ipcomp*.c and lets the standard xfrm_state destruction > take place. > > This is based on the discovery and patch by Alexey Dobriyan. > > Tested-by: Alexey Dobriyan <adobriyan@gmail.com> > Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Applied to net-2.6 -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c index 38fbf04..544ce08 100644 --- a/net/ipv4/ipcomp.c +++ b/net/ipv4/ipcomp.c @@ -124,16 +124,12 @@ static int ipcomp4_init_state(struct xfrm_state *x) if (x->props.mode == XFRM_MODE_TUNNEL) { err = ipcomp_tunnel_attach(x); if (err) - goto error_tunnel; + goto out; } err = 0; out: return err; - -error_tunnel: - ipcomp_destroy(x); - goto out; } static const struct xfrm_type ipcomp_type = { diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c index 2f2a5ca..002e6ee 100644 --- a/net/ipv6/ipcomp6.c +++ b/net/ipv6/ipcomp6.c @@ -154,16 +154,12 @@ static int ipcomp6_init_state(struct xfrm_state *x) if (x->props.mode == XFRM_MODE_TUNNEL) { err = ipcomp6_tunnel_attach(x); if (err) - goto error_tunnel; + goto out; } err = 0; out: return err; -error_tunnel: - ipcomp_destroy(x); - - goto out; } static const struct xfrm_type ipcomp6_type =