Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f1925ca5 authored by Haishuang Yan's avatar Haishuang Yan Committed by David S. Miller
Browse files

ip6_tunnel: fix potential issue in __ip6_tnl_rcv 



When __ip6_tnl_rcv fails, the tun_dst won't be freed, so call
dst_release to free it in error code path.

Fixes: 8d79266b ("ip6_tunnel: add collect_md mode to IPv6 tunnels")
CC: Alexei Starovoitov <ast@fb.com>
Tested-by: default avatarZhang Shengju <zhangshengju@cmss.chinamobile.com>
Signed-off-by: default avatarHaishuang Yan <yanhaishuang@cmss.chinamobile.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 469f87e1

net/ipv6/ip6_tunnel.c

+2 −0
Original line number Diff line number Diff line
@@ -858,6 +858,8 @@ static int __ip6_tnl_rcv(struct ip6_tnl *tunnel, struct sk_buff *skb, 
	return 0;



drop:

	if (tun_dst)

		dst_release((struct dst_entry *)tun_dst);

	kfree_skb(skb);

	return 0;

}