ipcomp: Avoid duplicate calls to ipcomp_destroy

When ipcomp_tunnel_attach fails we will call ipcomp_destroy twice.
This may lead to double-frees on certain structures.

As there is no reason to explicitly call ipcomp_destroy, this patch
removes it from ipcomp*.c and lets the standard xfrm_state destruction
take place.

This is based on the discovery and patch by Alexey Dobriyan.

Tested-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 38fbf04150ae7ec60ccafa1a4bd740995fb13427..544ce0876f12dcd78cfcf0d777e1b78bab5b4acf 100644 (file)
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -124,16 +124,12 @@ static int ipcomp4_init_state(struct xfrm_state *x)
        if (x->props.mode == XFRM_MODE_TUNNEL) {
                err = ipcomp_tunnel_attach(x);
                if (err)
-                       goto error_tunnel;
+                       goto out;
        }
 
        err = 0;
 out:
        return err;
-
-error_tunnel:
-       ipcomp_destroy(x);
-       goto out;
 }
 
 static const struct xfrm_type ipcomp_type = {

diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 2f2a5ca2c8786599560f7328d64401f837ab5e38..002e6eef91204ea9f21e49a36660fc0e3952fd81 100644 (file)
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -154,16 +154,12 @@ static int ipcomp6_init_state(struct xfrm_state *x)
        if (x->props.mode == XFRM_MODE_TUNNEL) {
                err = ipcomp6_tunnel_attach(x);
                if (err)
-                       goto error_tunnel;
+                       goto out;
        }
 
        err = 0;
 out:
        return err;
-error_tunnel:
-       ipcomp_destroy(x);
-
-       goto out;
 }
 
 static const struct xfrm_type ipcomp6_type =