[TCPv6]: Fix skb leak

Spotted by Francois Romieu, thanks!

Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 62c0e5bd931c7aa458083b00e2d81850f8c1b4e0..8827389abaf72a0f568251aeefeeea14809123b6 100644 (file)
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -992,13 +992,12 @@ static void tcp_v6_send_reset(struct sk_buff *skb)
        /* sk = NULL, but it is safe for now. RST socket required. */
        if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
 
-               if ((xfrm_lookup(&buff->dst, &fl, NULL, 0)) < 0)
+               if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
+                       ip6_xmit(NULL, buff, &fl, NULL, 0);
+                       TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
+                       TCP_INC_STATS_BH(TCP_MIB_OUTRSTS);
                        return;
-
-               ip6_xmit(NULL, buff, &fl, NULL, 0);
-               TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
-               TCP_INC_STATS_BH(TCP_MIB_OUTRSTS);
-               return;
+               }
        }
 
        kfree_skb(buff);
@@ -1057,11 +1056,11 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
        fl.fl_ip_sport = t1->source;
 
        if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
-               if ((xfrm_lookup(&buff->dst, &fl, NULL, 0)) < 0)
+               if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
+                       ip6_xmit(NULL, buff, &fl, NULL, 0);
+                       TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
                        return;
-               ip6_xmit(NULL, buff, &fl, NULL, 0);
-               TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
-               return;
+               }
        }
 
        kfree_skb(buff);