Commit 469f87e1 authored by Haishuang Yan's avatar Haishuang Yan Committed by David S. Miller

ip_tunnel: fix potential issue in ip_tunnel_rcv

When ip_tunnel_rcv fails, the tun_dst won't be freed, so call
dst_release to free it in error code path.

Fixes: 2e15ea39 ("ip_gre: Add support to collect tunnel metadata.")
Acked-by: default avatarEric Dumazet <edumazet@google.com>
Acked-by: default avatarPravin B Shelar <pshelar@ovn.org>
Tested-by: default avatarZhang Shengju <zhangshengju@cmss.chinamobile.com>
Signed-off-by: default avatarHaishuang Yan <yanhaishuang@cmss.chinamobile.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent be56a099
...@@ -446,6 +446,8 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb, ...@@ -446,6 +446,8 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
return 0; return 0;
drop: drop:
if (tun_dst)
dst_release((struct dst_entry *)tun_dst);
kfree_skb(skb); kfree_skb(skb);
return 0; return 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment