From: Phil Oester <kernel@linuxace.com>
Date: Wed, 19 Jun 2013 10:49:51 +0000 (-0400)
Subject: netfilter: nf_conntrack_ipv6: Plug sk_buff leak in fragment handling
X-Git-Tag: v3.10~13^2~12^2~3
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=142dcdd3c25fc7a3866bb06980e8f93a2ed7e050;p=pandora-kernel.git

netfilter: nf_conntrack_ipv6: Plug sk_buff leak in fragment handling

In commit 4cdd3408 ("netfilter: nf_conntrack_ipv6: improve fragmentation
handling"), an sk_buff leak was introduced when dealing with reassembled
packets by grabbing a reference to the original skb instead of the
reassembled skb.  At this point, the leak only impacted conntracks with an
associated helper.

In commit 58a317f1 ("netfilter: ipv6: add IPv6 NAT support"), the bug was
expanded to include all reassembled packets with unconfirmed conntracks.

Fix this by grabbing a reference to the proper reassembled skb.  This
closes netfilter bugzilla #823.

Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

Reading git-diff-tree failed