ipv6 devconf.c can attempt to kfree non-heap memory

While trying to add a new ipv6 option, I apparently screwed something up and caused one of the sysctl_register calls to fail. Since I'm not using name-spaces, all and dflt point to something other than heap memory. The kfree then panics when it tries to free them.

I'm not sure this can case ever happen in the real world, but it's probably worth fixing anyway.

This is from kernel 2.6.25.4, net/ipv6/addrconf.c

static int addrconf_init_net(struct net *net)

{
	int err;
	struct ipv6_devconf *all, *dflt;

	err = -ENOMEM;
	all = &ipv6_devconf;
	dflt = &ipv6_devconf_dflt;

	if (net != &init_net) {
		all = kmemdup(all, sizeof(ipv6_devconf), GFP_KERNEL);
		if (all == NULL)
			goto err_alloc_all;

		dflt = kmemdup(dflt, sizeof(ipv6_devconf_dflt), GFP_KERNEL);
		if (dflt == NULL)
			goto err_alloc_dflt;
	}

	net->ipv6.devconf_all = all;
	net->ipv6.devconf_dflt = dflt;

#ifdef CONFIG_SYSCTL
	err = __addrconf_sysctl_register(net, "all", NET_PROTO_CONF_ALL,
			NULL, all);
	if (err < 0)
		goto err_reg_all;

	err = __addrconf_sysctl_register(net, "default", NET_PROTO_CONF_DEFAULT,
			NULL, dflt);
	if (err < 0)
		goto err_reg_dflt;
#endif
	return 0;

#ifdef CONFIG_SYSCTL
err_reg_dflt:

	__addrconf_sysctl_unregister(all);
err_reg_all:
	kfree(dflt);
#endif
err_alloc_dflt:
	kfree(all);
err_alloc_all:
	return err;
}

Ben Greear <[email protected]>
Candela Technologies Inc  http://www.candelatech.com