The 'md' is allocated from 'tun_dst = ip_tun_rx_dst' and
since we've checked 'tun_dst', 'md' will never be NULL.
The patch removes it at both ipv4 and ipv6 erspan.

Fixes: afb4c97d90e6 ("ip6_gre: fix potential memory leak in ip6erspan_rcv")
Fixes: 50670b6ee9bc ("ip_gre: fix potential memory leak in erspan_rcv")
Cc: Haishuang Yan <yanhaishu...@cmss.chinamobile.com>
Signed-off-by: William Tu <u9012...@gmail.com>
---
 net/ipv4/ip_gre.c  | 5 -----
 net/ipv6/ip6_gre.c | 4 ----
 2 files changed, 9 deletions(-)

diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 90c912307814..47c7de3ca458 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -313,11 +313,6 @@ static int erspan_rcv(struct sk_buff *skb, struct 
tnl_ptk_info *tpi,
                                return PACKET_REJECT;
 
                        md = ip_tunnel_info_opts(&tun_dst->u.tun_info);
-                       if (!md) {
-                               dst_release((struct dst_entry *)tun_dst);
-                               return PACKET_REJECT;
-                       }
-
                        memcpy(md, pkt_md, sizeof(*md));
                        md->version = ver;
 
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 8451d00b210b..1aabc8df7cb7 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -550,10 +550,6 @@ static int ip6erspan_rcv(struct sk_buff *skb, int 
gre_hdr_len,
 
                        info = &tun_dst->u.tun_info;
                        md = ip_tunnel_info_opts(info);
-                       if (!md) {
-                               dst_release((struct dst_entry *)tun_dst);
-                               return PACKET_REJECT;
-                       }
 
                        memcpy(md, pkt_md, sizeof(*md));
                        md->version = ver;
-- 
2.7.4

Reply via email to