• Pavel Emelyanov's avatar
    [INET]: Fix potential kfree on vmalloc-ed area of request_sock_queue · dab6ba36
    Pavel Emelyanov authored
    The request_sock_queue's listen_opt is either vmalloc-ed or
    kmalloc-ed depending on the number of table entries. Thus it 
    is expected to be handled properly on free, which is done in 
    the reqsk_queue_destroy().
    
    However the error path in inet_csk_listen_start() calls 
    the lite version of reqsk_queue_destroy, called 
    __reqsk_queue_destroy, which calls the kfree unconditionally. 
    
    Fix this and move the __reqsk_queue_destroy into a .c file as 
    it looks too big to be inline.
    
    As David also noticed, this is an error recovery path only,
    so no locking is required and the lopt is known to be not NULL.
    
    reqsk_queue_yank_listen_sk is also now only used in
    net/core/request_sock.c so we should move it there too.
    Signed-off-by: default avatarPavel Emelyanov <xemul@openvz.org>
    Acked-by: default avatarEric Dumazet <dada1@cosmosbay.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    dab6ba36
request_sock.h 6.34 KB