tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
fork atom

[TCPv6]: Fix skb leak

Spotted by Francois Romieu, thanks!

Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by Arnaldo Carvalho de Melo and committed by David S. Miller ecc51b6d 66e05225

+9 -10
unified split
+9 -10
net/ipv6/tcp_ipv6.c
··· 992 992 /* sk = NULL, but it is safe for now. RST socket required. */ 993 993 if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) { 994 994 995 - if ((xfrm_lookup(&buff->dst, &fl, NULL, 0)) < 0) 995 + if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) { 996 + ip6_xmit(NULL, buff, &fl, NULL, 0); 997 + TCP_INC_STATS_BH(TCP_MIB_OUTSEGS); 998 + TCP_INC_STATS_BH(TCP_MIB_OUTRSTS); 996 999 return; 997 - 998 - ip6_xmit(NULL, buff, &fl, NULL, 0); 999 - TCP_INC_STATS_BH(TCP_MIB_OUTSEGS); 1000 - TCP_INC_STATS_BH(TCP_MIB_OUTRSTS); 1001 - return; 1000 + } 1002 1001 } 1003 1002 1004 1003 kfree_skb(buff); ··· 1056 1057 fl.fl_ip_sport = t1->source; 1057 1058 1058 1059 if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) { 1059 - if ((xfrm_lookup(&buff->dst, &fl, NULL, 0)) < 0) 1060 + if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) { 1061 + ip6_xmit(NULL, buff, &fl, NULL, 0); 1062 + TCP_INC_STATS_BH(TCP_MIB_OUTSEGS); 1060 1063 return; 1061 - ip6_xmit(NULL, buff, &fl, NULL, 0); 1062 - TCP_INC_STATS_BH(TCP_MIB_OUTSEGS); 1063 - return; 1064 + } 1064 1065 } 1065 1066 1066 1067 kfree_skb(buff);