Subject: [PATCH 1/2] netfilter: fix a memory leak in nf_conntrack_in

From: Maciej Żenczykowski <[email-masked]>
Date: Mon, 7 Oct 2019 22:35:06 -0700

From: Maciej Żenczykowski <[email-masked]>

Cc: Cong Wang <[email-masked]>
Cc: Eric Dumazet <[email-masked]>
Cc: Pablo Neira Ayuso <[email-masked]>
Signed-off-by: Maciej Żenczykowski <[email-masked]>
---
 net/netfilter/nf_conntrack_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 0c63120b2db2..35459d04a050 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1679,7 +1679,8 @@ nf_conntrack_in(struct sk_buff *skb, const struct nf_hook_state *state)
 		if ((tmpl && !nf_ct_is_template(tmpl)) ||
 		     ctinfo == IP_CT_UNTRACKED) {
 			NF_CT_STAT_INC_ATOMIC(state->net, ignore);
-			return NF_ACCEPT;
+			ret = NF_ACCEPT;
+			goto out;
 		}
 		skb->_nfct = 0;
 	}
-- 
2.23.0.581.g78d2f28ef7-goog