On Thu, 15 Nov 2007 11:41:37 +0300 Pavel Emelyanov <[EMAIL PROTECTED]> wrote:
> The request_sock_queue's listen_opt is either vmalloc-ed or > kmalloc-ed depending on the number of table entries. Thus it > is expected to be handled properly on free, which is done in > the reqsk_queue_destroy(). > > However the error path in inet_csk_listen_start() calls > the lite version of reqsk_queue_destroy, called > __reqsk_queue_destroy, which calls the kfree unconditionally. > > Fix this and move the __reqsk_queue_destroy into a .c file as > it looks too big to be inline. > > As David also noticed, this is an error recovery path only, > so no locking is required and the lopt is known to be not NULL. > > Signed-off-by: Pavel Emelyanov <[EMAIL PROTECTED]> > Acked-by: Eric Dumazet <[EMAIL PROTECTED]> Thank you for finding this bug Pavel - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
