Skip to contentSkip to conversation

xfrm: fix a possible policy leak

PATCH In review [email protected] 1 participant 2 messages May 8, 2015

Subsystems (3)
Networking Network drivers Networking IPsec
lore
Share & tools
lore

[email protected]

author
#0 lore raw

PATCH 1/1 xfrm: fix a possible policy leak

From: "Signed-off-by: Li RongQing" <[email protected]>

policy should be put if exit xfrm_policy_bysel_ctx() due to the failure of calling security_xfrm_policy_delete. since policy has been hold before

Fixes ef41aaa0b7 [IPSEC]: xfrm_policy delete security check misplaced
Signed-off-by Li RongQing <[email protected]>
Cc Eric Paris <[email protected]>
---
 net/xfrm/xfrm_policy.c | 2 ++
 1 file changed, 2 insertions(+)
net/xfrm/xfrm_policy.c +2 -0
index 3d264e5..66450c3 100644
@@ -824,6 +824,7 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u8 type,
 				*err = security_xfrm_policy_delete(
 								pol->security);
 				if (*err) {
+					xfrm_pol_put(pol);
 					write_unlock_bh(&net->xfrm.xfrm_policy_lock);
 					return pol;
 				}

@@ -863,6 +864,7 @@ struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8 type,
 				*err = security_xfrm_policy_delete(
 								pol->security);
 				if (*err) {
+					xfrm_pol_put(pol);
 					write_unlock_bh(&net->xfrm.xfrm_policy_lock);
 					return pol;
 				}
Signature · 1 line
2.1.0