]> git.baikalelectronics.ru Git - kernel.git/commit
[INET]: Fix potential kfree on vmalloc-ed area of request_sock_queue
authorPavel Emelyanov <xemul@openvz.org>
Thu, 15 Nov 2007 10:57:06 +0000 (02:57 -0800)
committerDavid S. Miller <davem@davemloft.net>
Thu, 15 Nov 2007 10:57:06 +0000 (02:57 -0800)
commita7cb4b2a1f5a657ff5121962aaa9072694811883
treeb838883cd5cd8f55f2bcb31f16430dd5a10dcbca
parent515e60713655b8b2501d5b2873211b1bb596e640
[INET]: Fix potential kfree on vmalloc-ed area of request_sock_queue

The request_sock_queue's listen_opt is either vmalloc-ed or
kmalloc-ed depending on the number of table entries. Thus it
is expected to be handled properly on free, which is done in
the reqsk_queue_destroy().

However the error path in inet_csk_listen_start() calls
the lite version of reqsk_queue_destroy, called
__reqsk_queue_destroy, which calls the kfree unconditionally.

Fix this and move the __reqsk_queue_destroy into a .c file as
it looks too big to be inline.

As David also noticed, this is an error recovery path only,
so no locking is required and the lopt is known to be not NULL.

reqsk_queue_yank_listen_sk is also now only used in
net/core/request_sock.c so we should move it there too.

Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Acked-by: Eric Dumazet <dada1@cosmosbay.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/net/request_sock.h
net/core/request_sock.c