[IPV4]: Fix DST leak in icmp_push_reply()

Based upon a bug report and initial patch by
Ollie Wild.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by Patrick McHardy and committed by David S. Miller cb94c62c 22783649

+6 -6
+6 -6
net/ipv4/icmp.c
··· 349 349 { 350 350 struct sk_buff *skb; 351 351 352 - ip_append_data(icmp_socket->sk, icmp_glue_bits, icmp_param, 353 - icmp_param->data_len+icmp_param->head_len, 354 - icmp_param->head_len, 355 - ipc, rt, MSG_DONTWAIT); 356 - 357 - if ((skb = skb_peek(&icmp_socket->sk->sk_write_queue)) != NULL) { 352 + if (ip_append_data(icmp_socket->sk, icmp_glue_bits, icmp_param, 353 + icmp_param->data_len+icmp_param->head_len, 354 + icmp_param->head_len, 355 + ipc, rt, MSG_DONTWAIT) < 0) 356 + ip_flush_pending_frames(icmp_socket->sk); 357 + else if ((skb = skb_peek(&icmp_socket->sk->sk_write_queue)) != NULL) { 358 358 struct icmphdr *icmph = skb->h.icmph; 359 359 unsigned int csum = 0; 360 360 struct sk_buff *skb1;