diff options
| author | Roy Li <rongqing.li@windriver.com> | 2011-09-20 15:10:16 -0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2011-09-20 15:10:16 -0400 |
| commit | 8603e33d01cb6bd32de46b2596fe47f0c4df6c12 (patch) | |
| tree | 38460cb5479a4df4d3c09626998c0294767583b7 | |
| parent | fe7d189d4a2ccbb3590b1da97a3f6a83fc2efd80 (diff) | |
ipv6: fix a possible double free
When calling snmp6_alloc_dev fails, the snmp6 relevant memory
are freed by snmp6_alloc_dev. Calling in6_dev_finish_destroy
will free these memory twice.
Double free will lead that undefined behavior occurs.
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/ipv6/addrconf.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index f012ebd87b4..12368c58606 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -374,8 +374,8 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev) "%s(): cannot allocate memory for statistics; dev=%s.\n", __func__, dev->name)); neigh_parms_release(&nd_tbl, ndev->nd_parms); - ndev->dead = 1; - in6_dev_finish_destroy(ndev); + dev_put(dev); + kfree(ndev); return NULL; } |