From: Jesper Nilsson Date: Fri, 27 Mar 2009 07:17:45 +0000 (-0700) Subject: ipv6: Plug sk_buff leak in ipv6_rcv (net/ipv6/ip6_input.c) X-Git-Tag: v2.6.27.22~44 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d1a2496e6da4dc33279e9037b58c397cb5d19436;p=pandora-kernel.git ipv6: Plug sk_buff leak in ipv6_rcv (net/ipv6/ip6_input.c) [ Upstream commit 71f6f6dfdf7c7a67462386d9ea05c1095a89c555 ] Commit 778d80be52699596bf70e0eb0761cf5e1e46088d (ipv6: Add disable_ipv6 sysctl to disable IPv6 operaion on specific interface) seems to have introduced a leak of sk_buff's for ipv6 traffic, at least in some configurations where idev is NULL, or when ipv6 is disabled via sysctl. The problem is that if the first condition of the if-statement returns non-NULL, it returns an skb with only one reference, and when the other conditions apply, execution jumps to the "out" label, which does not call kfree_skb for it. To plug this leak, change to use the "drop" label instead. (this relies on it being ok to call kfree_skb on NULL) This also allows us to avoid calling rcu_read_unlock here, and removes the only user of the "out" label. Signed-off-by: Jesper Nilsson Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- Reading git-diff-tree failed