[PATCH] ax25 fix for premature free.

[Stephen Hemminger <shemminger@xxxxxxxx>]

The problem is that you are freeing the ax25 control block too soon for the case
of sockets that were never bound.  If the socket is not bound, it never makes it
into the node list and the refcount is 1.  So when you decrement in ax25_cb_del
by calling ax25_cb_put it gets freed.  

This fixes the problem, it assumes your earlier patch has been applied.

diff -Nru a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
--- a/net/ax25/af_ax25.c        Tue Aug 12 15:35:33 2003
+++ b/net/ax25/af_ax25.c        Tue Aug 12 15:35:33 2003
@@ -66,10 +66,12 @@
  */
 static void ax25_cb_del(ax25_cb *ax25)
 {
-       spin_lock_bh(&ax25_list_lock);
-       hlist_del_init(&ax25->ax25_node);
-       spin_unlock_bh(&ax25_list_lock);
-       ax25_cb_put(ax25);
+       if (!hlist_unhashed(&ax25->ax25_node)) {
+               spin_lock_bh(&ax25_list_lock);
+               hlist_del(&ax25->ax25_node);
+               spin_unlock_bh(&ax25_list_lock);
+               ax25_cb_put(ax25);
+       }
 }
 
 /*