Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ecc51b6d authored by Arnaldo Carvalho de Melo's avatar Arnaldo Carvalho de Melo Committed by David S. Miller
Browse files

[TCPv6]: Fix skb leak 



Spotted by Francois Romieu, thanks!

Signed-off-by: default avatarArnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 66e05225

net/ipv6/tcp_ipv6.c

+9 −10
Original line number Diff line number Diff line
@@ -992,14 +992,13 @@ static void tcp_v6_send_reset(struct sk_buff *skb) 
	/* sk = NULL, but it is safe for now. RST socket required. */

	if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {



		if ((xfrm_lookup(&buff->dst, &fl, NULL, 0)) < 0)

			return;



		if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {

			ip6_xmit(NULL, buff, &fl, NULL, 0);

			TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);

			TCP_INC_STATS_BH(TCP_MIB_OUTRSTS);

			return;

		}

	}



	kfree_skb(buff);

}
@@ -1057,12 +1056,12 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 
	fl.fl_ip_sport = t1->source;



	if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {

		if ((xfrm_lookup(&buff->dst, &fl, NULL, 0)) < 0)

			return;

		if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {

			ip6_xmit(NULL, buff, &fl, NULL, 0);

			TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);

			return;

		}

	}



	kfree_skb(buff);

}