sit: Add missing kfree_skb() on pskb_may_pull() failure (CVE-2008-2136)

[backport of 2.6 commit 36ca34cc3b8335eb1fe8bd9a1d0a2592980c3f02]

Noticed by Paul Marks <paul@pmarks.net>.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>

diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 0808d45..204cbb4 100644 (file)
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -410,9 +410,9 @@ int ipip6_rcv(struct sk_buff *skb)
        }
 
        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PROT_UNREACH, 0);
-       kfree_skb(skb);
        read_unlock(&ipip6_lock);
 out:
+       kfree_skb(skb);
        return 0;
 }