sit: Add missing kfree_skb() on pskb_may_pull() failure. (CVE-2008-2136)

Noticed by Paul Marks <paul@pmarks.net>.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@kernel.org>

diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index c2d3e17beae60cc1b2dcfdf4e4d46c7d57b12d05..ef367f3aa6641522ffc5e58123d9f70fb729f350 100644 (file)
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -398,9 +398,9 @@ static int ipip6_rcv(struct sk_buff *skb)
        }
 
        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PROT_UNREACH, 0);
-       kfree_skb(skb);
        read_unlock(&ipip6_lock);
 out:
+       kfree_skb(skb);
        return 0;
 }