bridge: Fix skb leak when multicast parsing fails on TX

On the bridge TX path we're leaking an skb when br_multicast_rcv
returns an error.

Reported-by: David Lamparter <equinox@diac24.net>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 3 insertions, 1 deletions

diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 4cec8051164d..f49bcd9d9113 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -48,8 +48,10 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 
         rcu_read_lock();
         if (is_multicast_ether_addr(dest)) {
-                if (br_multicast_rcv(br, NULL, skb))
+                if (br_multicast_rcv(br, NULL, skb)) {
+                        kfree_skb(skb);
                         goto out;
+                }
 
                 mdst = br_mdb_get(br, skb);
                 if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb))