Commit cc6aebd4 authored by Muli Ben-Yehuda's avatar Muli Ben-Yehuda Committed by David S. Miller

[NETFILTER]: ip_queue memory leaks

parent dacfd283
...@@ -300,8 +300,9 @@ ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info, void *data) ...@@ -300,8 +300,9 @@ ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info, void *data)
write_lock_bh(&queue_lock); write_lock_bh(&queue_lock);
if (!peer_pid) if (!peer_pid)
goto err_out_unlock; goto err_out_free_nskb;
/* netlink_unicast will either free the nskb or attach it to a socket */
status = netlink_unicast(ipqnl, nskb, peer_pid, MSG_DONTWAIT); status = netlink_unicast(ipqnl, nskb, peer_pid, MSG_DONTWAIT);
if (status < 0) if (status < 0)
goto err_out_unlock; goto err_out_unlock;
...@@ -312,6 +313,9 @@ ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info, void *data) ...@@ -312,6 +313,9 @@ ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info, void *data)
write_unlock_bh(&queue_lock); write_unlock_bh(&queue_lock);
return status; return status;
err_out_free_nskb:
kfree_skb(nskb);
err_out_unlock: err_out_unlock:
write_unlock_bh(&queue_lock); write_unlock_bh(&queue_lock);
......
...@@ -304,8 +304,9 @@ ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info, void *data) ...@@ -304,8 +304,9 @@ ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info, void *data)
write_lock_bh(&queue_lock); write_lock_bh(&queue_lock);
if (!peer_pid) if (!peer_pid)
goto err_out_unlock; goto err_out_free_nskb;
/* netlink_unicast will either free the nskb or attach it to a socket */
status = netlink_unicast(ipqnl, nskb, peer_pid, MSG_DONTWAIT); status = netlink_unicast(ipqnl, nskb, peer_pid, MSG_DONTWAIT);
if (status < 0) if (status < 0)
goto err_out_unlock; goto err_out_unlock;
...@@ -317,6 +318,9 @@ ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info, void *data) ...@@ -317,6 +318,9 @@ ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info, void *data)
write_unlock_bh(&queue_lock); write_unlock_bh(&queue_lock);
return status; return status;
err_out_free_nskb:
kfree_skb(nskb);
err_out_unlock: err_out_unlock:
write_unlock_bh(&queue_lock); write_unlock_bh(&queue_lock);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment