ip6_gre: fix potential memory leak in ip6erspan_rcv

If md is NULL, tun_dst must be freed, otherwise it will cause memory
leak.

Fixes: ef7baf5e083c ("ip6_gre: add ip6 erspan collect_md mode")
Cc: William Tu <[email protected]>
Signed-off-by: Haishuang Yan <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index b7a79ddcf8516bc725220f073127e9b9f58acfbc..8451d00b210bc5abad36df8ccdd540b2024db1af 100644 (file)
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -550,8 +550,10 @@ static int ip6erspan_rcv(struct sk_buff *skb, int gre_hdr_len,
 
                        info = &tun_dst->u.tun_info;
                        md = ip_tunnel_info_opts(info);
-                       if (!md)
+                       if (!md) {
+                               dst_release((struct dst_entry *)tun_dst);
                                return PACKET_REJECT;
+                       }
 
                        memcpy(md, pkt_md, sizeof(*md));
                        md->version = ver;