[PATCH 2/2] xfrm Fix potential error pointer dereference in xfrm_bundle_create.

[Steffen Klassert]

We may derference an invalid pointer in the error path of
xfrm_bundle_create(). Fix this by returning this error
pointer directly instead of assigning it to xdst0.

Fixes: 45b018beddb6 ("ipsec: Create and use new helpers for dst child access.")
Signed-off-by: Steffen Klassert <steffen.klass...@secunet.com>
---
 net/xfrm/xfrm_policy.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 40b54cc64243..5f48251c1319 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1658,7 +1658,6 @@ static struct dst_entry *xfrm_bundle_create(struct 
xfrm_policy *policy,
                trailer_len -= xdst_prev->u.dst.xfrm->props.trailer_len;
        }
 
-out:
        return &xdst0->u.dst;
 
 put_states:
@@ -1667,8 +1666,8 @@ static struct dst_entry *xfrm_bundle_create(struct 
xfrm_policy *policy,
 free_dst:
        if (xdst0)
                dst_release_immediate(&xdst0->u.dst);
-       xdst0 = ERR_PTR(err);
-       goto out;
+
+       return ERR_PTR(err);
 }
 
 static int xfrm_expand_policies(const struct flowi *fl, u16 family,
-- 
2.14.1