vti6: Fix memory leak of skb if input policy check fails

stable inclusion
from linux-4.19.114
commit 7df44c92854964ff5540756dd47507908e4e63cf

--------------------------------

commit 2a9de3af upstream.

The vti6_rcv function performs some tests on the retrieved tunnel
including checking the IP protocol, the XFRM input policy, the
source and destination address.

In all but one places the skb is released in the error case. When
the input policy check fails the network packet is leaked.

Using the same goto-label discard in this case to fix this problem.

Fixes: ed1efb2a ("ipv6: Add support for IPsec virtual tunnel interfaces")
Signed-off-by: NTorsten Hilbrich <torsten.hilbrich@secunet.com>
Reviewed-by: NNicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: NSteffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: NLi Aichun <liaichun@huawei.com>
Reviewed-by: Nguodeqing <geffrey.guo@huawei.com>
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>

net/ipv6/ip6_vti.c

@@ -315,7 +315,7 @@ static int vti6_rcv(struct sk_buff *skb)
 
 		if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
 			rcu_read_unlock();
-			return 0;
+			goto discard;
 		}
 
 		ipv6h = ipv6_hdr(skb);