[PATCH]: Fix for recently introduced rawv6 bug.

[PATCH]: Fix for recently introduced rawv6 bug.

[David Miller]

Al Viro noticed that we have two assignments to
rawv6_prot.destroy, fix below with more details in
the commit message.

I'll commit this to net-2.6 and push to Linus.

Thanks Al!

ipv6: Fix duplicate initialization of rawv6_prot.destroy

In changeset 22dd485022f3d0b162ceb5e67d85de7c3806aa20
("raw: Raw socket leak.") code was added so that we
flush pending frames on raw sockets to avoid leaks.

The ipv4 part was fine, but the ipv6 part was not
done correctly.  Unlike the ipv4 side, the ipv6 code
already has a .destroy method for rawv6_prot.

So now there were two assignments to this member, and
what the compiler does is use the last one, effectively
making the ipv6 parts of that changeset a NOP.

Fix this by removing the:

	.destroy	   = inet6_destroy_sock,

line, and adding an inet6_destroy_sock() call to the
end of raw6_destroy().

Noticed by Al Viro.

Signed-off-by: David S. Miller <davem@davemloft.net>
---
 net/ipv6/raw.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 8fee9a1..3aee123 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1169,7 +1169,8 @@ static int raw6_destroy(struct sock *sk)
 	lock_sock(sk);
 	ip6_flush_pending_frames(sk);
 	release_sock(sk);
-	return 0;
+
+	return inet6_destroy_sock(sk);
 }
 
 static int rawv6_init_sk(struct sock *sk)
@@ -1200,7 +1201,6 @@ struct proto rawv6_prot = {
 	.disconnect	   = udp_disconnect,
 	.ioctl		   = rawv6_ioctl,
 	.init		   = rawv6_init_sk,
-	.destroy	   = inet6_destroy_sock,
 	.setsockopt	   = rawv6_setsockopt,
 	.getsockopt	   = rawv6_getsockopt,
 	.sendmsg	   = rawv6_sendmsg,
-- 
1.5.5.1.308.g1fbb5

Re: [PATCH]: Fix for recently introduced rawv6 bug.

[Al Viro]

On Thu, Jun 12, 2008 at 02:49:33PM -0700, David Miller wrote:
> 
> Al Viro noticed that we have two assignments to
> rawv6_prot.destroy, fix below with more details in
> the commit message.
> 
> I'll commit this to net-2.6 and push to Linus.

ACK.  Why does ->destroy() return int, BTW?  All in-tree instances return 0
and AFAICS there's nothing caller could possibly do in case of error anyway...

Re: [PATCH]: Fix for recently introduced rawv6 bug.

[David Miller]

From: Al Viro <viro@ZenIV.linux.org.uk>
Date: Thu, 12 Jun 2008 23:05:53 +0100

> Why does ->destroy() return int, BTW?  All in-tree instances return
> 0 and AFAICS there's nothing caller could possibly do in case of
> error anyway...

Yes it could be changed to return "void" and I'll try to do
that in the net-next-2.6 tree.

Re: [PATCH]: Fix for recently introduced rawv6 bug.

[YOSHIFUJI Hideaki / 吉藤英明]

In article <20080612.144933.184241072.davem@davemloft.net> (at Thu, 12 Jun 2008 14:49:33 -0700 (PDT)), David Miller <davem@davemloft.net> says:

> ipv6: Fix duplicate initialization of rawv6_prot.destroy
:
> Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

--yoshfuji