Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[IPSEC]: Fix potential dst leak in xfrm_lookup

Browse source 
If we get an error during the actual policy lookup we don't free the
original dst while the caller expects us to always free the original
dst in case of error.

This patch fixes that.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Herbert Xu 2007-12-11 04:38:08 -08:00 committed by David S. Miller
parent 3f03e38789
commit 75b8c13326
1 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
net/xfrm/xfrm_policy.c
View file

@ -1318,8 +1318,9 @@ int __xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
if (sk && sk->sk_policy[XFRM_POLICY_OUT]) { if (sk && sk->sk_policy[XFRM_POLICY_OUT]) {
policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl); policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
err = PTR_ERR(policy);
if (IS_ERR(policy)) if (IS_ERR(policy))
return PTR_ERR(policy); goto dropdst;
} }
if (!policy) { if (!policy) {
@ -1330,8 +1331,9 @@ int __xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
policy = flow_cache_lookup(fl, dst_orig->ops->family, policy = flow_cache_lookup(fl, dst_orig->ops->family,
dir, xfrm_policy_lookup); dir, xfrm_policy_lookup);
err = PTR_ERR(policy);
if (IS_ERR(policy)) if (IS_ERR(policy))
return PTR_ERR(policy); goto dropdst;
} }
if (!policy) if (!policy)
@ -1501,8 +1503,9 @@ int __xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
return 0; return 0;
error: error:
dst_release(dst_orig);
xfrm_pols_put(pols, npols); xfrm_pols_put(pols, npols);
dropdst:
dst_release(dst_orig);
*dst_p = NULL; *dst_p = NULL;
return err; return err;
} }