redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

ipv6: syncookies: free reqsk on xfrm_lookup error 

cookie_v6_check() did not call reqsk_free() if xfrm_lookup() fails,
leaking the request sock.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
hifive-unleashed-5.1
Florian Westphal 2008-08-03 18:13:44 -07:00 committed by David S. Miller
parent adf044c877
commit 1730554f25
1 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
net/ipv6/syncookies.c
View File

@ -199,10 +199,8 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
ireq6 = inet6_rsk(req);
treq = tcp_rsk(req);
if (security_inet_conn_request(sk, skb, req)) {
reqsk_free(req);
goto out;
}
if (security_inet_conn_request(sk, skb, req))
goto out_free;
req->mss = mss;
ireq->rmt_port = th->source;
@ -255,14 +253,13 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
fl.fl_ip_dport = inet_rsk(req)->rmt_port;
fl.fl_ip_sport = inet_sk(sk)->sport;
security_req_classify_flow(req, &fl);
if (ip6_dst_lookup(sk, &dst, &fl)) {
reqsk_free(req);
goto out;
}
if (ip6_dst_lookup(sk, &dst, &fl))
goto out_free;
if (final_p)
ipv6_addr_copy(&fl.fl6_dst, final_p);
if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
goto out;
goto out_free;
}
req->window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
@ -273,7 +270,10 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
ireq->rcv_wscale = rcv_wscale;
ret = get_cookie_sock(sk, skb, req, dst);
out: return ret;
out:
return ret;
out_free:
reqsk_free(req);
return NULL;
}