Commit 2c84b0aa authored by Justin Iurman's avatar Justin Iurman Committed by Jakub Kicinski
Browse files

net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input 



Free the skb before returning from rpl_input when skb_cow_head() fails.
Use a "drop" label and goto instructions.

Fixes: a7a29f9c ("net: ipv6: add rpl sr tunnel")
Signed-off-by: default avatarJustin Iurman <justin.iurman@uliege.be>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20240911174557.11536-1-justin.iurman@uliege.be


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent b9c7ac4f

net/ipv6/rpl_iptunnel.c

+7 −5
Original line number Diff line number Diff line
@@ -263,10 +263,8 @@ static int rpl_input(struct sk_buff *skb) 
	rlwt = rpl_lwt_lwtunnel(orig_dst->lwtstate);



	err = rpl_do_srh(skb, rlwt);

	if (unlikely(err)) {

		kfree_skb(skb);

		return err;

	}

	if (unlikely(err))

		goto drop;



	local_bh_disable();

	dst = dst_cache_get(&rlwt->cache);
@@ -286,9 +284,13 @@ static int rpl_input(struct sk_buff *skb) 


	err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev));

	if (unlikely(err))

		return err;

		goto drop;



	return dst_input(skb);



drop:

	kfree_skb(skb);

	return err;

}



static int nla_put_rpl_srh(struct sk_buff *skb, int attrtype,