Commit d56159f6 authored by Hideaki Yoshifuji's avatar Hideaki Yoshifuji

[IPV6] IPSEC: fix double kfree_skb() in error path. (reported by Ken-ichirou...

[IPV6] IPSEC: fix double kfree_skb() in error path. (reported by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>)
Signed-off-by: default avatarYoshifuji Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: default avatarDavid S. Miller <davem@redhat.com>
parent dca8ede4
...@@ -572,34 +572,26 @@ static void udpv6_mcast_deliver(struct udphdr *uh, ...@@ -572,34 +572,26 @@ static void udpv6_mcast_deliver(struct udphdr *uh,
struct sk_buff *skb) struct sk_buff *skb)
{ {
struct sock *sk, *sk2; struct sock *sk, *sk2;
struct sk_buff *buff;
int dif; int dif;
read_lock(&udp_hash_lock); read_lock(&udp_hash_lock);
sk = sk_head(&udp_hash[ntohs(uh->dest) & (UDP_HTABLE_SIZE - 1)]); sk = sk_head(&udp_hash[ntohs(uh->dest) & (UDP_HTABLE_SIZE - 1)]);
dif = skb->dev->ifindex; dif = skb->dev->ifindex;
sk = udp_v6_mcast_next(sk, uh->dest, daddr, uh->source, saddr, dif); sk = udp_v6_mcast_next(sk, uh->dest, daddr, uh->source, saddr, dif);
if (!sk) if (!sk) {
goto free_skb; kfree_skb(skb);
goto out;
}
buff = NULL;
sk2 = sk; sk2 = sk;
while ((sk2 = udp_v6_mcast_next(sk_next(sk2), uh->dest, daddr, while ((sk2 = udp_v6_mcast_next(sk_next(sk2), uh->dest, daddr,
uh->source, saddr, dif))) { uh->source, saddr, dif))) {
if (!buff) { struct sk_buff *buff = skb_clone(skb, GFP_ATOMIC);
buff = skb_clone(skb, GFP_ATOMIC);
if (!buff)
continue;
}
if (udpv6_queue_rcv_skb(sk2, buff) >= 0)
buff = NULL;
}
if (buff) if (buff)
kfree_skb(buff); udpv6_queue_rcv_skb(sk2, buff);
if (udpv6_queue_rcv_skb(sk, skb) < 0) {
free_skb:
kfree_skb(skb);
} }
udpv6_queue_rcv_skb(sk, skb);
out:
read_unlock(&udp_hash_lock); read_unlock(&udp_hash_lock);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment