* [PATCH ipsec] xfrm: fix refcount leak in xfrm_migrate_policy_find
@ 2026-04-04 9:05 Kotlyarov Mihail
2026-04-04 9:33 ` Florian Westphal
0 siblings, 1 reply; 2+ messages in thread
From: Kotlyarov Mihail @ 2026-04-04 9:05 UTC (permalink / raw)
To: netdev
Cc: Kotlyarov Mihail, lvc-project, steffen.klassert, herbert, davem,
edumazet, kuba, pabeni, horms, fw, linux-kernel
syzkaller reported a memory leak in xfrm_policy_alloc:
BUG: memory leak
unreferenced object 0xffff888114d79000 (size 1024):
comm "syz.1.17", pid 931
...
xfrm_policy_alloc+0xb3/0x4b0 net/xfrm/xfrm_policy.c:432
The root cause is a double call to xfrm_pol_hold_rcu() in
xfrm_migrate_policy_find(). The lookup function already returns
a policy with held reference, making the second call redundant.
Remove the redundant xfrm_pol_hold_rcu() call to fix the refcount
imbalance and prevent the memory leak.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 563d5ca93e88 ("xfrm: switch migrate to xfrm_policy_lookup_bytype")
Signed-off-by: Kotlyarov Mihail <mihailkotlyarow@gmail.com>
---
net/xfrm/xfrm_policy.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 62486f866975..8566bc464668 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -4517,9 +4517,6 @@ static struct xfrm_policy *xfrm_migrate_policy_find(const struct xfrm_selector *
pol = xfrm_policy_lookup_bytype(net, type, &fl, sel->family, dir, if_id);
if (IS_ERR_OR_NULL(pol))
goto out_unlock;
-
- if (!xfrm_pol_hold_rcu(pol))
- pol = NULL;
out_unlock:
rcu_read_unlock();
return pol;
--
2.53.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH ipsec] xfrm: fix refcount leak in xfrm_migrate_policy_find
2026-04-04 9:05 [PATCH ipsec] xfrm: fix refcount leak in xfrm_migrate_policy_find Kotlyarov Mihail
@ 2026-04-04 9:33 ` Florian Westphal
0 siblings, 0 replies; 2+ messages in thread
From: Florian Westphal @ 2026-04-04 9:33 UTC (permalink / raw)
To: Kotlyarov Mihail
Cc: netdev, lvc-project, steffen.klassert, herbert, davem, edumazet,
kuba, pabeni, horms, linux-kernel
Kotlyarov Mihail <mihailkotlyarow@gmail.com> wrote:
> syzkaller reported a memory leak in xfrm_policy_alloc:
>
> BUG: memory leak
> unreferenced object 0xffff888114d79000 (size 1024):
> comm "syz.1.17", pid 931
> ...
> xfrm_policy_alloc+0xb3/0x4b0 net/xfrm/xfrm_policy.c:432
>
> The root cause is a double call to xfrm_pol_hold_rcu() in
> xfrm_migrate_policy_find(). The lookup function already returns
> a policy with held reference, making the second call redundant.
> Remove the redundant xfrm_pol_hold_rcu() call to fix the refcount
> imbalance and prevent the memory leak.
Reviewed-by: Florian Westphal <fw@strlen.de>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-04-04 9:33 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-04 9:05 [PATCH ipsec] xfrm: fix refcount leak in xfrm_migrate_policy_find Kotlyarov Mihail
2026-04-04 9:33 ` Florian Westphal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox