ipv6: syncookies: free reqsk on xfrm_lookup error

cookie_v6_check() did not call reqsk_free() if xfrm_lookup() fails,
leaking the request sock.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Florian Westphal 2008-08-03 18:13:44 -07:00 committed by David S. Miller
parent adf044c877
commit 1730554f25
1 changed files with 11 additions and 11 deletions

View File

@ -199,10 +199,8 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
ireq6 = inet6_rsk(req); ireq6 = inet6_rsk(req);
treq = tcp_rsk(req); treq = tcp_rsk(req);
if (security_inet_conn_request(sk, skb, req)) { if (security_inet_conn_request(sk, skb, req))
reqsk_free(req); goto out_free;
goto out;
}
req->mss = mss; req->mss = mss;
ireq->rmt_port = th->source; ireq->rmt_port = th->source;
@ -255,14 +253,13 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
fl.fl_ip_dport = inet_rsk(req)->rmt_port; fl.fl_ip_dport = inet_rsk(req)->rmt_port;
fl.fl_ip_sport = inet_sk(sk)->sport; fl.fl_ip_sport = inet_sk(sk)->sport;
security_req_classify_flow(req, &fl); security_req_classify_flow(req, &fl);
if (ip6_dst_lookup(sk, &dst, &fl)) { if (ip6_dst_lookup(sk, &dst, &fl))
reqsk_free(req); goto out_free;
goto out;
}
if (final_p) if (final_p)
ipv6_addr_copy(&fl.fl6_dst, final_p); ipv6_addr_copy(&fl.fl6_dst, final_p);
if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0) if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
goto out; goto out_free;
} }
req->window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW); req->window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
@ -273,7 +270,10 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
ireq->rcv_wscale = rcv_wscale; ireq->rcv_wscale = rcv_wscale;
ret = get_cookie_sock(sk, skb, req, dst); ret = get_cookie_sock(sk, skb, req, dst);
out:
out: return ret; return ret;
out_free:
reqsk_free(req);
return NULL;
} }