Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 10e7454e authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller
Browse files

ipcomp: Avoid duplicate calls to ipcomp_destroy 



When ipcomp_tunnel_attach fails we will call ipcomp_destroy twice.
This may lead to double-frees on certain structures.

As there is no reason to explicitly call ipcomp_destroy, this patch
removes it from ipcomp*.c and lets the standard xfrm_state destruction
take place.

This is based on the discovery and patch by Alexey Dobriyan.

Tested-by: default avatarAlexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1cab819b

net/ipv4/ipcomp.c

+1 −5
Original line number Diff line number Diff line
@@ -124,16 +124,12 @@ static int ipcomp4_init_state(struct xfrm_state *x) 
	if (x->props.mode == XFRM_MODE_TUNNEL) {

		err = ipcomp_tunnel_attach(x);

		if (err)

			goto error_tunnel;

			goto out;

	}



	err = 0;

out:

	return err;



error_tunnel:

	ipcomp_destroy(x);

	goto out;

}



static const struct xfrm_type ipcomp_type = {

net/ipv6/ipcomp6.c

+1 −5
Original line number Diff line number Diff line
@@ -154,16 +154,12 @@ static int ipcomp6_init_state(struct xfrm_state *x) 
	if (x->props.mode == XFRM_MODE_TUNNEL) {

		err = ipcomp6_tunnel_attach(x);

		if (err)

			goto error_tunnel;

			goto out;

	}



	err = 0;

out:

	return err;

error_tunnel:

	ipcomp_destroy(x);



	goto out;

}



static const struct xfrm_type ipcomp6_type =