svn commit: r363009 - stable/11/sys/netinet

[Mark Johnston]

Author: markj
Date: Wed Jul  8 13:40:27 2020
New Revision: 363009
URL: https://svnweb.freebsd.org/changeset/base/363009

Log:
  MFC r362840:
  Fix a possible refcount leak when handling IPSec traffic.
  
  PR:	246951

Modified:
  stable/11/sys/netinet/ip_input.c

Modified: stable/11/sys/netinet/ip_input.c
==============================================================================
--- stable/11/sys/netinet/ip_input.c	Wed Jul  8 12:25:19 2020	(r363008)
+++ stable/11/sys/netinet/ip_input.c	Wed Jul  8 13:40:27 2020	(r363009)
@@ -1023,6 +1023,8 @@ ip_forward(struct mbuf *m, int srcrt)
 	if (IPSEC_ENABLED(ipv4)) {
 		if ((error = IPSEC_FORWARD(ipv4, m)) != 0) {
 			/* mbuf consumed by IPsec */
+			if (ia != NULL)
+				ifa_free(&ia->ia_ifa);
 			m_freem(mcopy);
 			if (error != EINPROGRESS)
 				IPSTAT_INC(ips_cantforward);