diff options
| author | Herbert Xu <herbert@gondor.apana.org.au> | 2007-12-11 04:38:08 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2007-12-11 04:38:08 -0800 |
| commit | 75b8c133267053c9986a7c8db5131f0e7349e806 (patch) | |
| tree | 264a44a1882196c894f1af84baf7fbba7698678c /net | |
| parent | 3f03e387893ffa07a4d5dac96772f9db3221a185 (diff) | |
| download | op-kernel-dev-75b8c133267053c9986a7c8db5131f0e7349e806.zip op-kernel-dev-75b8c133267053c9986a7c8db5131f0e7349e806.tar.gz | |
[IPSEC]: Fix potential dst leak in xfrm_lookup
If we get an error during the actual policy lookup we don't free the
original dst while the caller expects us to always free the original
dst in case of error.
This patch fixes that.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/xfrm/xfrm_policy.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 9a4cf2e..b91b166 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -1318,8 +1318,9 @@ restart: if (sk && sk->sk_policy[XFRM_POLICY_OUT]) { policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl); + err = PTR_ERR(policy); if (IS_ERR(policy)) - return PTR_ERR(policy); + goto dropdst; } if (!policy) { @@ -1330,8 +1331,9 @@ restart: policy = flow_cache_lookup(fl, dst_orig->ops->family, dir, xfrm_policy_lookup); + err = PTR_ERR(policy); if (IS_ERR(policy)) - return PTR_ERR(policy); + goto dropdst; } if (!policy) @@ -1501,8 +1503,9 @@ restart: return 0; error: - dst_release(dst_orig); xfrm_pols_put(pols, npols); +dropdst: + dst_release(dst_orig); *dst_p = NULL; return err; } |
