[IPV6] ADDRLABEL: Fix double free on label deletion.
authorYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Mon, 28 Jan 2008 23:46:02 +0000 (15:46 -0800)
committerDavid S. Miller <davem@davemloft.net>
Mon, 28 Jan 2008 23:46:02 +0000 (15:46 -0800)
commit85040bcb4643cba578839e953f25e2d1965d83d0
treed43d6a0d92e2957be260312214084131cf659833
parent3c582b30bc2592081e9b23e253ca098fa7d57dc2
[IPV6] ADDRLABEL: Fix double free on label deletion.

If an entry is being deleted because it has only one reference,
we immediately delete it and blindly register the rcu handler for it,
This results in oops by double freeing that object.

This patch fixes it by consolidating the code paths for the deletion;
let its rcu handler delete the object if it has no more reference.

Bug was found by Mitsuru Chinen <mitch@linux.vnet.ibm.com>

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv6/addrlabel.c