From: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Date: Wed, 10 May 2006 20:24:38 +0000 (-0700)
Subject: [IPV6]: skb leakage in inet6_csk_xmit
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=b0013fd47b14fc26eec07a6b2cec0c2a8954e1d7;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git

[IPV6]: skb leakage in inet6_csk_xmit

inet6_csk_xit does not free skb when routing fails.

Signed-off-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index f8f3a37a1494..eb2865d5ae28 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -173,6 +173,7 @@ int inet6_csk_xmit(struct sk_buff *skb, int ipfragok)
 
 		if (err) {
 			sk->sk_err_soft = -err;
+			kfree_skb(skb);
 			return err;
 		}
 
@@ -181,6 +182,7 @@ int inet6_csk_xmit(struct sk_buff *skb, int ipfragok)
 
 		if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) {
 			sk->sk_route_caps = 0;
+			kfree_skb(skb);
 			return err;
 		}