From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 2 Jun 2011 13:08:45 +0000 (+0200)
Subject: netfilter: nf_conntrack: fix ct refcount leak in l4proto->error()
X-Git-Tag: v3.0-rc3~13^2~28^2~1
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=88ed01d17b44bc2bed4ad4835d3b1099bff3dd71;p=pandora-kernel.git

netfilter: nf_conntrack: fix ct refcount leak in l4proto->error()

This patch fixes a refcount leak of ct objects that may occur if
l4proto->error() assigns one conntrack object to one skbuff. In
that case, we have to skip further processing in nf_conntrack_in().

With this patch, we can also fix wrong return values (-NF_ACCEPT)
for special cases in ICMP[v6] that should not bump the invalid/error
statistic counters.

Reported-by: Zoltan Menyhart <Zoltan.Menyhart@bull.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

Reading git-diff-tree failed