ip_tunnel: fix possible rtable leak

ip_rt_put(rt) is always called in "error" branches above, but was missed in
skb_cow_head branch. As rt is not yet bound to skb here we have to release it by
hand.

Signed-off-by: Dmitry Popov <ixaphire@qrator.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 2acc2337d38bfe7f35517e13952cfa8a306c24fd..3f6135bc54ef07cc2c71838f619897752d414b75 100644 (file)
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -668,6 +668,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
                dev->needed_headroom = max_headroom;
 
        if (skb_cow_head(skb, dev->needed_headroom)) {
+               ip_rt_put(rt);
                dev->stats.tx_dropped++;
                kfree_skb(skb);
                return;