Commit f8dc01f5 authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller

[XFRM]: Fix leak in ah6_input

tmp_hdr is not freed when ipv6_clear_mutable_options fails.

Coverity #650
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f6e57464
...@@ -279,7 +279,7 @@ static int ah6_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struc ...@@ -279,7 +279,7 @@ static int ah6_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struc
goto out; goto out;
memcpy(tmp_hdr, skb->nh.raw, hdr_len); memcpy(tmp_hdr, skb->nh.raw, hdr_len);
if (ipv6_clear_mutable_options(skb->nh.ipv6h, hdr_len)) if (ipv6_clear_mutable_options(skb->nh.ipv6h, hdr_len))
goto out; goto free_out;
skb->nh.ipv6h->priority = 0; skb->nh.ipv6h->priority = 0;
skb->nh.ipv6h->flow_lbl[0] = 0; skb->nh.ipv6h->flow_lbl[0] = 0;
skb->nh.ipv6h->flow_lbl[1] = 0; skb->nh.ipv6h->flow_lbl[1] = 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment