net: ipmr/ip6mr: prevent out-of-bounds vif_table access

[safe/jmp/linux-2.6] / net / ipv4 / ip_fragment.c

diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 9f41bd3..b59430b 100644 (file)
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -234,10 +234,9 @@ static void ip_expire(unsigned long arg)
 
                /* Send an ICMP "Fragment Reassembly Timeout" message. */
                icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
-       }
-
 out_rcu_unlock:
-       rcu_read_unlock();
+               rcu_read_unlock();
+       }
 out:
        spin_unlock(&qp->q.lock);
        ipq_put(qp);