summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorRoy Li <rongqing.li@windriver.com>2011-09-20 15:10:16 -0400
committerDavid S. Miller <davem@davemloft.net>2011-09-20 15:10:16 -0400
commit8603e33d01cb6bd32de46b2596fe47f0c4df6c12 (patch)
tree38460cb5479a4df4d3c09626998c0294767583b7 /net
parentfe7d189d4a2ccbb3590b1da97a3f6a83fc2efd80 (diff)
ipv6: fix a possible double free
When calling snmp6_alloc_dev fails, the snmp6 relevant memory are freed by snmp6_alloc_dev. Calling in6_dev_finish_destroy will free these memory twice. Double free will lead that undefined behavior occurs. Signed-off-by: Roy Li <rongqing.li@windriver.com> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/ipv6/addrconf.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index f012ebd87b43..12368c586068 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -374,8 +374,8 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
"%s(): cannot allocate memory for statistics; dev=%s.\n",
__func__, dev->name));
neigh_parms_release(&nd_tbl, ndev->nd_parms);
- ndev->dead = 1;
- in6_dev_finish_destroy(ndev);
+ dev_put(dev);
+ kfree(ndev);
return NULL;
}