* [PATCH net-next] ipv6: fix a possible double free
@ 2011-09-20 5:52 rongqing.li
2011-09-20 19:10 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: rongqing.li @ 2011-09-20 5:52 UTC (permalink / raw)
To: netdev, eric.dumazet, stable
From: Roy.Li <rongqing.li@windriver.com>
When calling snmp6_alloc_dev fails, the snmp6 relevant memory
are freed by snmp6_alloc_dev. Calling in6_dev_finish_destroy
will free these memory twice.
Double free will lead that undefined behavior occurs.
Signed-off-by: Roy.Li <rongqing.li@windriver.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
---
net/ipv6/addrconf.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index f012ebd..12368c5 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -374,8 +374,8 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
"%s(): cannot allocate memory for statistics; dev=%s.\n",
__func__, dev->name));
neigh_parms_release(&nd_tbl, ndev->nd_parms);
- ndev->dead = 1;
- in6_dev_finish_destroy(ndev);
+ dev_put(dev);
+ kfree(ndev);
return NULL;
}
--
1.7.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net-next] ipv6: fix a possible double free
2011-09-20 5:52 [PATCH net-next] ipv6: fix a possible double free rongqing.li
@ 2011-09-20 19:10 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2011-09-20 19:10 UTC (permalink / raw)
To: rongqing.li; +Cc: netdev, eric.dumazet, stable
From: <rongqing.li@windriver.com>
Date: Tue, 20 Sep 2011 13:52:16 +0800
> From: Roy.Li <rongqing.li@windriver.com>
>
> When calling snmp6_alloc_dev fails, the snmp6 relevant memory
> are freed by snmp6_alloc_dev. Calling in6_dev_finish_destroy
> will free these memory twice.
>
> Double free will lead that undefined behavior occurs.
>
> Signed-off-by: Roy.Li <rongqing.li@windriver.com>
> Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Applied and queued up for -stable, thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-09-20 19:12 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-09-20 5:52 [PATCH net-next] ipv6: fix a possible double free rongqing.li
2011-09-20 19:10 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).