diff options
| author | Patrick McHardy <kaber@trash.net> | 2005-06-18 22:45:31 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2005-06-18 22:45:31 -0700 |
| commit | 7d6dfe1f5bc4c56e0c31173014a099ec3fa35907 (patch) | |
| tree | a6b04337c4f6d1ff7b050082dc7e69dc5617d3d0 /net/xfrm | |
| parent | f60f6b8f70c756fc786d68f02ec17a1e84db645f (diff) | |
| download | op-kernel-dev-7d6dfe1f5bc4c56e0c31173014a099ec3fa35907.zip op-kernel-dev-7d6dfe1f5bc4c56e0c31173014a099ec3fa35907.tar.gz | |
[IPSEC] Fix xfrm_state leaks in error path
Herbert Xu wrote:
> @@ -1254,6 +1326,7 @@ static int pfkey_add(struct sock *sk, st
> if (IS_ERR(x))
> return PTR_ERR(x);
>
> + xfrm_state_hold(x);
This introduces a leak when xfrm_state_add()/xfrm_state_update()
fail. We hold two references (one from xfrm_state_alloc(), one
from xfrm_state_hold()), but only drop one. We need to take the
reference because the reference from xfrm_state_alloc() can
be dropped by __xfrm_state_delete(), so the fix is to drop both
references on error. Same problem in xfrm_user.c.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/xfrm')
| -rw-r--r-- | net/xfrm/xfrm_user.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index bc4fd74..9d30f73 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -296,7 +296,7 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma) if (err < 0) { x->km.state = XFRM_STATE_DEAD; xfrm_state_put(x); - return err; + goto out; } c.seq = nlh->nlmsg_seq; @@ -304,8 +304,8 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma) c.event = nlh->nlmsg_type; km_state_notify(x, &c); +out: xfrm_state_put(x); - return err; } |
