diff options
author | Herbert Xu <herbert@gondor.apana.org.au> | 2010-02-15 14:24:30 -0500 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2010-02-16 17:53:24 -0500 |
commit | 10e7454ed7a2da39f1f6255f63d7df27ab4bb67f (patch) | |
tree | 467bf2ee42e91914ac679ad871a87ea2ecb3925f /net/ipv6 | |
parent | 1cab819b5e244e1b853c7b440981e6a960da3bfb (diff) |
ipcomp: Avoid duplicate calls to ipcomp_destroy
When ipcomp_tunnel_attach fails we will call ipcomp_destroy twice.
This may lead to double-frees on certain structures.
As there is no reason to explicitly call ipcomp_destroy, this patch
removes it from ipcomp*.c and lets the standard xfrm_state destruction
take place.
This is based on the discovery and patch by Alexey Dobriyan.
Tested-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6')
-rw-r--r-- | net/ipv6/ipcomp6.c | 6 |
1 files changed, 1 insertions, 5 deletions
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c index 2f2a5ca2c878..002e6eef9120 100644 --- a/net/ipv6/ipcomp6.c +++ b/net/ipv6/ipcomp6.c | |||
@@ -154,16 +154,12 @@ static int ipcomp6_init_state(struct xfrm_state *x) | |||
154 | if (x->props.mode == XFRM_MODE_TUNNEL) { | 154 | if (x->props.mode == XFRM_MODE_TUNNEL) { |
155 | err = ipcomp6_tunnel_attach(x); | 155 | err = ipcomp6_tunnel_attach(x); |
156 | if (err) | 156 | if (err) |
157 | goto error_tunnel; | 157 | goto out; |
158 | } | 158 | } |
159 | 159 | ||
160 | err = 0; | 160 | err = 0; |
161 | out: | 161 | out: |
162 | return err; | 162 | return err; |
163 | error_tunnel: | ||
164 | ipcomp_destroy(x); | ||
165 | |||
166 | goto out; | ||
167 | } | 163 | } |
168 | 164 | ||
169 | static const struct xfrm_type ipcomp6_type = | 165 | static const struct xfrm_type ipcomp6_type = |