Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=77adefdc9863d63f8d8bdc6a9adcdf9a6b0e2410
Commit:     77adefdc9863d63f8d8bdc6a9adcdf9a6b0e2410
Parent:     aacbe8c8800adfea42eb754396c6ebcd992cb36a
Author:     YOSHIFUJI Hideaki <[EMAIL PROTECTED]>
AuthorDate: Tue Nov 20 17:31:23 2007 -0800
Committer:  David S. Miller <[EMAIL PROTECTED]>
CommitDate: Tue Nov 20 17:31:23 2007 -0800

    [IPV6] TCPMD5: Fix deleting key operation.
    
    Due to the bug, refcnt for md5sig pool was leaked when
    an user try to delete a key if we have more than one key.
    In addition to the leakage, we returned incorrect return
    result value for userspace.
    
    This fix should close Bug #9418, reported by <[EMAIL PROTECTED]>.
    
    Signed-off-by: YOSHIFUJI Hideaki <[EMAIL PROTECTED]>
    Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
---
 net/ipv6/tcp_ipv6.c |    6 ++----
 1 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index b1bfbdd..93980c3 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -637,10 +637,6 @@ static int tcp_v6_md5_do_del(struct sock *sk, struct 
in6_addr *peer)
                                kfree(tp->md5sig_info->keys6);
                                tp->md5sig_info->keys6 = NULL;
                                tp->md5sig_info->alloced6 = 0;
-
-                               tcp_free_md5sig_pool();
-
-                               return 0;
                        } else {
                                /* shrink the database */
                                if (tp->md5sig_info->entries6 != i)
@@ -649,6 +645,8 @@ static int tcp_v6_md5_do_del(struct sock *sk, struct 
in6_addr *peer)
                                                (tp->md5sig_info->entries6 - i)
                                                * sizeof 
(tp->md5sig_info->keys6[0]));
                        }
+                       tcp_free_md5sig_pool();
+                       return 0;
                }
        }
        return -ENOENT;
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to