inet: fix various use-after-free in defrags units

[linux-2.6-microblaze.git] / include / net / ipv6_frag.h

diff --git a/include/net/ipv6_frag.h b/include/net/ipv6_frag.h
index 1f77fb4..a21e8b1 100644 (file)
--- a/include/net/ipv6_frag.h
+++ b/include/net/ipv6_frag.h
@@ -67,6 +67,8 @@ ip6frag_expire_frag_queue(struct net *net, struct frag_queue *fq)
        struct sk_buff *head;
 
        rcu_read_lock();
+       if (fq->q.fqdir->dead)
+               goto out_rcu_unlock;
        spin_lock(&fq->q.lock);
 
        if (fq->q.flags & INET_FRAG_COMPLETE)