Revert "dst: Use after free in __dst_destroy_metrics_generic"
This reverts commit 6709ad14626b82d094b09d6f1737af0acbc4073d.
The fix was done because it appeared as if memory of the
__DST_METRICS_PTR(old) was freed in some path and allocated
to ion driver. ion driver had also freed it. Finally the memory
was freed by the fib gc and crashes since it is already
deallocated. But this fix is causing Kernel Memory leak and
therefore reverted.
Change-Id: I2de19ff195f55eecd2b467c8cb5aa97b44db3ebd
Signed-off-by: Chinmay Agarwal <chinagar@codeaurora.org>
diff --git a/net/core/dst.c b/net/core/dst.c
index b5de366..39cc119 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -349,15 +349,8 @@ void __dst_destroy_metrics_generic(struct dst_entry *dst, unsigned long old)
new = ((unsigned long) &dst_default_metrics) | DST_METRICS_READ_ONLY;
prev = cmpxchg(&dst->_metrics, old, new);
- if (prev == old) {
- struct dst_metrics *old_p = (struct dst_metrics *)
- __DST_METRICS_PTR(old);
-
- if (prev & DST_METRICS_REFCOUNTED) {
- if (atomic_dec_and_test(&old_p->refcnt))
- kfree(old_p);
- }
- }
+ if (prev == old)
+ kfree(__DST_METRICS_PTR(old));
}
EXPORT_SYMBOL(__dst_destroy_metrics_generic);