[IPV6] fix a dst leakage and clean-up in tcp_v6_connect()

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index d22230f166ad405b9d54f96b1f01e454f0d7ac97..21b165ec5339c1ba5050c3c30b2b1404f96e47f7 100644 (file)
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -544,7 +544,6 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct tcp_opt *tp = tcp_sk(sk);
        struct in6_addr *saddr = NULL;
-       struct in6_addr saddr_buf;
        struct flowi fl;
        struct dst_entry *dst;
        int addr_type;
@@ -671,23 +670,24 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                goto failure;
        }
 
-       ip6_dst_store(sk, dst, NULL);
-       sk->sk_route_caps = dst->dev->features &
-                           ~(NETIF_F_IP_CSUM | NETIF_F_TSO);
-
        if (saddr == NULL) {
-               err = ipv6_get_saddr(dst, &np->daddr, &saddr_buf);
-               if (err)
+               err = ipv6_get_saddr(dst, &np->daddr, &fl.fl6_src);
+               if (err) {
+                       dst_release(dst);
                        goto failure;
-
-               saddr = &saddr_buf;
+               }
+               saddr = &fl.fl6_src;
+               ipv6_addr_copy(&np->rcv_saddr, saddr);
        }
 
        /* set the source address */
-       ipv6_addr_copy(&np->rcv_saddr, saddr);
        ipv6_addr_copy(&np->saddr, saddr);
        inet->rcv_saddr = LOOPBACK4_IPV6;
 
+       ip6_dst_store(sk, dst, NULL);
+       sk->sk_route_caps = dst->dev->features &
+                           ~(NETIF_F_IP_CSUM | NETIF_F_TSO);
+
        tp->ext_header_len = 0;
        if (np->opt)
                tp->ext_header_len = np->opt->opt_flen + np->opt->opt_nflen;
@@ -714,8 +714,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 
 late_failure:
        tcp_set_state(sk, TCP_CLOSE);
-failure:
        __sk_dst_reset(sk);
+failure:
        inet->dport = 0;
        sk->sk_route_caps = 0;
        return err;