GIT: unionfs2-2.6.27.y: netfilter: ip6t_REJECT: fix a dst leak in ipv6 REJECT

[Erez Zadok]

commit 30b816a516ba96aa85ce0290aa63cebd3d258b72
Author: Eric Dumazet <eric.dumazet at gmail.com>
Date:   Fri Jul 2 10:05:01 2010 +0200

    netfilter: ip6t_REJECT: fix a dst leak in ipv6 REJECT
    
    commit 499031ac8a3df6738f6186ded9da853e8ea18253 upstream.
    
    We should release dst if dst->error is set.
    
    Bug introduced in 2.6.14 by commit e104411b82f5c
    ([XFRM]: Always release dst_entry on error in xfrm_lookup)
    
    Signed-off-by: Eric Dumazet <eric.dumazet at gmail.com>
    Signed-off-by: Patrick McHardy <kaber at trash.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>

diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index 44c8d65..1be1a6c 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -95,9 +95,11 @@ static void send_reset(struct sk_buff *oldskb)
 	fl.fl_ip_dport = otcph.source;
 	security_skb_classify_flow(oldskb, &fl);
 	dst = ip6_route_output(&init_net, NULL, &fl);
-	if (dst == NULL)
+	if (dst == NULL || dst->error) {
+		dst_release(dst);
 		return;
-	if (dst->error || xfrm_lookup(&dst, &fl, NULL, 0))
+	}
+	if (xfrm_lookup(&dst, &fl, NULL, 0))
 		return;
 
 	hh_len = (dst->dev->hard_header_len + 15)&~15;