Skip to contentSkip to conversation

xfrm: fix a possible policy leak

PATCH In review [email protected] 2 participants 2 messages May 8, 2015 – May 11, 2015

Subsystems (3)
Networking Network drivers Networking IPsec
lore
Share & tools
lore

[email protected]

author
#0 lore raw

PATCH 1/1 xfrm: fix a possible policy leak

From: Li RongQing <[email protected]>

policy should be put if exit xfrm_policy_bysel_ctx() due to the failure of calling security_xfrm_policy_delete. since policy has been hold before

Fixes ef41aaa0b7 [IPSEC]: xfrm_policy delete security check misplaced
Signed-off-by Li RongQing <[email protected]>
Cc Eric Paris <[email protected]>
---
 net/xfrm/xfrm_policy.c | 2 ++
 1 file changed, 2 insertions(+)
net/xfrm/xfrm_policy.c +2 -0
index 3d264e5..66450c3 100644
@@ -824,6 +824,7 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u8 type,
 				*err = security_xfrm_policy_delete(
 								pol->security);
 				if (*err) {
+					xfrm_pol_put(pol);
 					write_unlock_bh(&net->xfrm.xfrm_policy_lock);
 					return pol;
 				}

@@ -863,6 +864,7 @@ struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8 type,
 				*err = security_xfrm_policy_delete(
 								pol->security);
 				if (*err) {
+					xfrm_pol_put(pol);
 					write_unlock_bh(&net->xfrm.xfrm_policy_lock);
 					return pol;
 				}
Signature · 1 line
2.1.0
maintainer
#1 lore raw
Quoted 26 lines · On Fri, May 08, 2015 at 05:39:39PM +0800, [email protected] wrote:

From: Li RongQing <[email protected]>

policy should be put if exit xfrm_policy_bysel_ctx() due to the failure of calling security_xfrm_policy_delete. since policy has been hold before

Fixes ef41aaa0b7 [IPSEC]: xfrm_policy delete security check misplaced
Signed-off-by Li RongQing <[email protected]>
Cc Eric Paris <[email protected]>
---
 net/xfrm/xfrm_policy.c | 2 ++
 1 file changed, 2 insertions(+)
net/xfrm/xfrm_policy.c +1 -0
index 3d264e5..66450c3 100644
@@ -824,6 +824,7 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u8 type,
 				*err = security_xfrm_policy_delete(
 								pol->security);
 				if (*err) {
+					xfrm_pol_put(pol);
 					write_unlock_bh(&net->xfrm.xfrm_policy_lock);
 					return pol;
 				}

net/xfrm/xfrm_policy.c struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8 type, · line 870

Quoted 7 lines
net/xfrm/xfrm_policy.c +1 -0
@@ -863,6 +864,7 @@ struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8 type,
 				*err = security_xfrm_policy_delete(
 								pol->security);
 				if (*err) {
+					xfrm_pol_put(pol);
 					write_unlock_bh(&net->xfrm.xfrm_policy_lock);
 					return pol;
 				}

We return this policy to the caller, so we better keep the refcount here. The caller is responsible to drop the refount.