bridge: Fix skb leak when multicast parsing fails on TX

[ Upstream commit 6d1d1d398cb7db7a12c5d652d50f85355345234f ]

On the bridge TX path we're leaking an skb when br_multicast_rcv
returns an error.

Reported-by: David Lamparter <equinox@diac24.net>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 5752057a924ac50cb9c3fb014bdbe7990eaddb13..5c8ee839bd084a9688e11f1ea54e4a31fbf6a962 100644 (file)
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -37,8 +37,10 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 
        rcu_read_lock();
        if (dest[0] & 1) {
-               if (br_multicast_rcv(br, NULL, skb))
+               if (br_multicast_rcv(br, NULL, skb)) {
+                       kfree_skb(skb);
                        goto out;
+               }
 
                mdst = br_mdb_get(br, skb);
                if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb))