* ipsec: Fix dst leak in xfrm_bundle_create().
@ 2017-10-11 3:59 David Miller
2017-10-11 11:54 ` Steffen Klassert
0 siblings, 1 reply; 2+ messages in thread
From: David Miller @ 2017-10-11 3:59 UTC (permalink / raw)
To: netdev; +Cc: steffen.klassert
If we cannot find a suitable inner_mode value, we will leak
the currently allocated 'xdst'.
The fix is to make sure it is linked into the chain before
erroring out.
Signed-off-by: David S. Miller <davem@davemloft.net>
---
Steffen, I found this via visual inspection. Please double check my
work before applying this :-)
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index f06253969972..2746b62a8944 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1573,6 +1573,14 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
goto put_states;
}
+ if (!dst_prev)
+ dst0 = dst1;
+ else
+ /* Ref count is taken during xfrm_alloc_dst()
+ * No need to do dst_clone() on dst1
+ */
+ dst_prev->child = dst1;
+
if (xfrm[i]->sel.family == AF_UNSPEC) {
inner_mode = xfrm_ip2inner_mode(xfrm[i],
xfrm_af2proto(family));
@@ -1584,14 +1592,6 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
} else
inner_mode = xfrm[i]->inner_mode;
- if (!dst_prev)
- dst0 = dst1;
- else
- /* Ref count is taken during xfrm_alloc_dst()
- * No need to do dst_clone() on dst1
- */
- dst_prev->child = dst1;
-
xdst->route = dst;
dst_copy_metrics(dst1, dst);
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: ipsec: Fix dst leak in xfrm_bundle_create().
2017-10-11 3:59 ipsec: Fix dst leak in xfrm_bundle_create() David Miller
@ 2017-10-11 11:54 ` Steffen Klassert
0 siblings, 0 replies; 2+ messages in thread
From: Steffen Klassert @ 2017-10-11 11:54 UTC (permalink / raw)
To: David Miller; +Cc: netdev
On Tue, Oct 10, 2017 at 08:59:38PM -0700, David Miller wrote:
>
> If we cannot find a suitable inner_mode value, we will leak
> the currently allocated 'xdst'.
>
> The fix is to make sure it is linked into the chain before
> erroring out.
>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> ---
>
> Steffen, I found this via visual inspection. Please double check my
> work before applying this :-)
Looks good. Patch applied, thanks David!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-10-11 11:54 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-10-11 3:59 ipsec: Fix dst leak in xfrm_bundle_create() David Miller
2017-10-11 11:54 ` Steffen Klassert
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).