* [PATCH] XFRM: Fix memory leak in xfrm_state_update
@ 2011-07-08 1:38 Tushar Gohad
2011-07-08 3:00 ` Herbert Xu
0 siblings, 1 reply; 3+ messages in thread
From: Tushar Gohad @ 2011-07-08 1:38 UTC (permalink / raw)
To: David Miller, Herbert Xu; +Cc: netdev, tusharsg
Upon "ip xfrm state update ..", xfrm_add_sa() takes an extra reference on
the user-supplied SA and forgets to drop the reference when
xfrm_state_update() returns 0. This leads to a memory leak as the
parameter SA is never freed. This change attempts to fix the leak by
calling __xfrm_state_put() when xfrm_state_update() updates a valid SA
(err = 0). The parameter SA is added to the gc list when the final
reference is dropped by xfrm_add_sa() upon completion.
Signed-off-by: Tushar Gohad <tgohad@mvista.com>
---
net/xfrm/xfrm_state.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index d70f85e..9414b9c 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1345,6 +1345,8 @@ out:
xfrm_state_check_expire(x1);
err = 0;
+ x->km.state = XFRM_STATE_DEAD;
+ __xfrm_state_put(x);
}
spin_unlock_bh(&x1->lock);
--
1.6.3.3.202.g91879
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] XFRM: Fix memory leak in xfrm_state_update
2011-07-08 1:38 [PATCH] XFRM: Fix memory leak in xfrm_state_update Tushar Gohad
@ 2011-07-08 3:00 ` Herbert Xu
2011-07-08 15:59 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: Herbert Xu @ 2011-07-08 3:00 UTC (permalink / raw)
To: Tushar Gohad; +Cc: David Miller, netdev, tusharsg
On Thu, Jul 07, 2011 at 06:38:52PM -0700, Tushar Gohad wrote:
>
> Upon "ip xfrm state update ..", xfrm_add_sa() takes an extra reference on
> the user-supplied SA and forgets to drop the reference when
> xfrm_state_update() returns 0. This leads to a memory leak as the
> parameter SA is never freed. This change attempts to fix the leak by
> calling __xfrm_state_put() when xfrm_state_update() updates a valid SA
> (err = 0). The parameter SA is added to the gc list when the final
> reference is dropped by xfrm_add_sa() upon completion.
>
> Signed-off-by: Tushar Gohad <tgohad@mvista.com>
Ouch, thanks for catching this bug!
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] XFRM: Fix memory leak in xfrm_state_update
2011-07-08 3:00 ` Herbert Xu
@ 2011-07-08 15:59 ` David Miller
0 siblings, 0 replies; 3+ messages in thread
From: David Miller @ 2011-07-08 15:59 UTC (permalink / raw)
To: herbert; +Cc: tgohad, netdev, tusharsg
From: Herbert Xu <herbert@gondor.hengli.com.au>
Date: Fri, 8 Jul 2011 11:00:32 +0800
> On Thu, Jul 07, 2011 at 06:38:52PM -0700, Tushar Gohad wrote:
>>
>> Upon "ip xfrm state update ..", xfrm_add_sa() takes an extra reference on
>> the user-supplied SA and forgets to drop the reference when
>> xfrm_state_update() returns 0. This leads to a memory leak as the
>> parameter SA is never freed. This change attempts to fix the leak by
>> calling __xfrm_state_put() when xfrm_state_update() updates a valid SA
>> (err = 0). The parameter SA is added to the gc list when the final
>> reference is dropped by xfrm_add_sa() upon completion.
>>
>> Signed-off-by: Tushar Gohad <tgohad@mvista.com>
>
> Ouch, thanks for catching this bug!
>
> Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Applied, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2011-07-08 15:59 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-07-08 1:38 [PATCH] XFRM: Fix memory leak in xfrm_state_update Tushar Gohad
2011-07-08 3:00 ` Herbert Xu
2011-07-08 15:59 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).