Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8603e33d authored by Roy Li's avatar Roy Li Committed by David S. Miller
Browse files

ipv6: fix a possible double free 



When calling snmp6_alloc_dev fails, the snmp6 relevant memory
are freed by snmp6_alloc_dev. Calling in6_dev_finish_destroy
will free these memory twice.

Double free will lead that undefined behavior occurs.

Signed-off-by: default avatarRoy Li <rongqing.li@windriver.com>
Acked-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent fe7d189d

net/ipv6/addrconf.c

+2 −2
Original line number Diff line number Diff line
@@ -374,8 +374,8 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev) 
			"%s(): cannot allocate memory for statistics; dev=%s.\n",

			__func__, dev->name));

		neigh_parms_release(&nd_tbl, ndev->nd_parms);

		ndev->dead = 1;

		in6_dev_finish_destroy(ndev);

		dev_put(dev);

		kfree(ndev);

		return NULL;

	}