[IPV6] IPSEC: fix double kfree_skb() in error path. (reported by Ken-ichirou MATSUZAW...

Signed-off-by: Yoshifuji Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@redhat.com>

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 798f266f05519c0cc1103764f4ca1654e309b631..0dc7f0ec1feab8923ef0b9499002962d28257776 100644 (file)
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -572,34 +572,26 @@ static void udpv6_mcast_deliver(struct udphdr *uh,
                                struct sk_buff *skb)
 {
        struct sock *sk, *sk2;
-       struct sk_buff *buff;
        int dif;
 
        read_lock(&udp_hash_lock);
        sk = sk_head(&udp_hash[ntohs(uh->dest) & (UDP_HTABLE_SIZE - 1)]);
        dif = skb->dev->ifindex;
        sk = udp_v6_mcast_next(sk, uh->dest, daddr, uh->source, saddr, dif);
-       if (!sk)
-               goto free_skb;
+       if (!sk) {
+               kfree_skb(skb);
+               goto out;
+       }
 
-       buff = NULL;
        sk2 = sk;
        while ((sk2 = udp_v6_mcast_next(sk_next(sk2), uh->dest, daddr,
                                        uh->source, saddr, dif))) {
-               if (!buff) {
-                       buff = skb_clone(skb, GFP_ATOMIC);
-                       if (!buff)
-                               continue;
-               }
-               if (udpv6_queue_rcv_skb(sk2, buff) >= 0)
-                       buff = NULL;
-       }
-       if (buff)
-               kfree_skb(buff);
-       if (udpv6_queue_rcv_skb(sk, skb) < 0) {
-free_skb:
-               kfree_skb(skb);
+               struct sk_buff *buff = skb_clone(skb, GFP_ATOMIC);
+               if (buff)
+                       udpv6_queue_rcv_skb(sk2, buff);
        }
+       udpv6_queue_rcv_skb(sk, skb);
+out:
        read_unlock(&udp_hash_lock);
 }