When tca_action_flush() calls the action walk() and gets an error,
a successful call to nla_nest_start() is not followed by a call to
nla_nest_cancel(). It's harmless, as the skb is freed in the error
path - but it's worth to fix this unbalance.

Signed-off-by: Davide Caratti <dcara...@redhat.com>
---
 net/sched/act_api.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index eba6682727dd..43f4991b7777 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -938,8 +938,10 @@ static int tca_action_flush(struct net *net, struct nlattr 
*nla,
                goto out_module_put;
 
        err = ops->walk(net, skb, &dcb, RTM_DELACTION, ops);
-       if (err <= 0)
+       if (err <= 0) {
+               nla_nest_cancel(skb, nest);
                goto out_module_put;
+       }
 
        nla_nest_end(skb, nest);
 
-- 
2.14.3

Reply via email to