From: David S. Miller <davem@davemloft.net>
Date: Mon, 14 Jul 2008 18:09:23 +0000 (+0300)
Subject: sit: Add missing kfree_skb() on pskb_may_pull() failure. (CVE-2008-2136)
X-Git-Tag: v2.6.16.61-rc1~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=873496a3485950402ee0436c9d17eeb789157b10;p=thirdparty%2Fkernel%2Fstable.git

sit: Add missing kfree_skb() on pskb_may_pull() failure. (CVE-2008-2136)

Noticed by Paul Marks <paul@pmarks.net>.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
---

diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index c2d3e17beae60..ef367f3aa6641 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -398,9 +398,9 @@ static int ipip6_rcv(struct sk_buff *skb)
 	}
 
 	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PROT_UNREACH, 0);
-	kfree_skb(skb);
 	read_unlock(&ipip6_lock);
 out:
+	kfree_skb(skb);
 	return 0;
 }