From: Alexey Dobriyan <adobriyan@gmail.com>
Date: Mon, 8 Sep 2008 01:20:36 +0000 (-0700)
Subject: netfilter: nf_conntrack_gre: nf_ct_gre_keymap_flush() fixlet
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=51807e91a76a531d059ec7ce3395c435e4df52a8;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git

netfilter: nf_conntrack_gre: nf_ct_gre_keymap_flush() fixlet

It does "kfree(list_head)" which looks wrong because entity that was
allocated is definitely not list_head.

However, this all works because list_head is first item in
struct nf_ct_gre_keymap.

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index b308bb4c12b9..9bd03967fea4 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -45,12 +45,12 @@ static LIST_HEAD(gre_keymap_list);
 
 void nf_ct_gre_keymap_flush(void)
 {
-	struct list_head *pos, *n;
+	struct nf_ct_gre_keymap *km, *tmp;
 
 	write_lock_bh(&nf_ct_gre_lock);
-	list_for_each_safe(pos, n, &gre_keymap_list) {
-		list_del(pos);
-		kfree(pos);
+	list_for_each_entry_safe(km, tmp, &gre_keymap_list, list) {
+		list_del(&km->list);
+		kfree(km);
 	}
 	write_unlock_bh(&nf_ct_gre_lock);
 }