Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 77adefdc authored by YOSHIFUJI Hideaki's avatar YOSHIFUJI Hideaki Committed by David S. Miller
Browse files

[IPV6] TCPMD5: Fix deleting key operation. 



Due to the bug, refcnt for md5sig pool was leaked when
an user try to delete a key if we have more than one key.
In addition to the leakage, we returned incorrect return
result value for userspace.

This fix should close Bug #9418, reported by <ming-baini@163.com>.

Signed-off-by: default avatarYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent aacbe8c8

net/ipv6/tcp_ipv6.c

+2 −4
Original line number Diff line number Diff line
@@ -637,10 +637,6 @@ static int tcp_v6_md5_do_del(struct sock *sk, struct in6_addr *peer) 
				kfree(tp->md5sig_info->keys6);

				tp->md5sig_info->keys6 = NULL;

				tp->md5sig_info->alloced6 = 0;



				tcp_free_md5sig_pool();



				return 0;

			} else {

				/* shrink the database */

				if (tp->md5sig_info->entries6 != i)
@@ -649,6 +645,8 @@ static int tcp_v6_md5_do_del(struct sock *sk, struct in6_addr *peer) 
						(tp->md5sig_info->entries6 - i)

						* sizeof (tp->md5sig_info->keys6[0]));

			}

			tcp_free_md5sig_pool();

			return 0;

		}

	}

	return -ENOENT;