From: YOSHIFUJI Hideaki Date: Wed, 21 Nov 2007 01:31:23 +0000 (-0800) Subject: [IPV6] TCPMD5: Fix deleting key operation. X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=77adefdc9863d63f8d8bdc6a9adcdf9a6b0e2410;p=GitHub%2Fmt8127%2Fandroid_kernel_alcatel_ttab.git [IPV6] TCPMD5: Fix deleting key operation. Due to the bug, refcnt for md5sig pool was leaked when an user try to delete a key if we have more than one key. In addition to the leakage, we returned incorrect return result value for userspace. This fix should close Bug #9418, reported by . Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller --- diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index b1bfbdd85d3c..93980c3b83e6 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -637,10 +637,6 @@ static int tcp_v6_md5_do_del(struct sock *sk, struct in6_addr *peer) kfree(tp->md5sig_info->keys6); tp->md5sig_info->keys6 = NULL; tp->md5sig_info->alloced6 = 0; - - tcp_free_md5sig_pool(); - - return 0; } else { /* shrink the database */ if (tp->md5sig_info->entries6 != i) @@ -649,6 +645,8 @@ static int tcp_v6_md5_do_del(struct sock *sk, struct in6_addr *peer) (tp->md5sig_info->entries6 - i) * sizeof (tp->md5sig_info->keys6[0])); } + tcp_free_md5sig_pool(); + return 0; } } return -ENOENT;