Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 499031ac authored by Eric Dumazet's avatar Eric Dumazet Committed by Patrick McHardy
Browse files

netfilter: ip6t_REJECT: fix a dst leak in ipv6 REJECT 



We should release dst if dst->error is set.

Bug introduced in 2.6.14 by commit e104411b
([XFRM]: Always release dst_entry on error in xfrm_lookup)

Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Cc: stable@kernel.org
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent aea9d711

net/ipv6/netfilter/ip6t_REJECT.c

+4 −2
Original line number Diff line number Diff line
@@ -97,9 +97,11 @@ static void send_reset(struct net *net, struct sk_buff *oldskb) 
	fl.fl_ip_dport = otcph.source;

	security_skb_classify_flow(oldskb, &fl);

	dst = ip6_route_output(net, NULL, &fl);

	if (dst == NULL)

	if (dst == NULL || dst->error) {

		dst_release(dst);

		return;

	if (dst->error || xfrm_lookup(net, &dst, &fl, NULL, 0))

	}

	if (xfrm_lookup(net, &dst, &fl, NULL, 0))

		return;



	hh_len = (dst->dev->hard_header_len + 15)&~15;