[PATCH] net: af_key: fix refcount leak in pfkey_spdadd()

[PATCH] net: af_key: fix refcount leak in pfkey_spdadd()

[WenTao Liang]

In pfkey_spdadd(), an xfrm policy is allocated via xfrm_policy_alloc()
with a refcount of 1. On the success path the policy is eventually freed
by xfrm_pol_put(), which decrements the refcount and calls
xfrm_policy_destroy() only when it reaches zero. However, all error
paths directly call xfrm_policy_destroy() without releasing the initial
reference, leaking the policy object.

Fix the leak by replacing the direct xfrm_policy_destroy() call with
xfrm_pol_put() in the error unwind. Keep the xp->walk.dead assignment
as it is required by xfrm_policy_destroy()'s BUG_ON check.

Cc: stable@vger.kernel.org
Fixes: 64c31b3f7648 ("[XFRM] xfrm_policy_destroy: Rename and relative fixes.")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
 net/key/af_key.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/key/af_key.c b/net/key/af_key.c
index 9cffeef18cd9..013592086f1e 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2370,7 +2370,7 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, const struct sadb_
 
 out:
 	xp->walk.dead = 1;
-	xfrm_policy_destroy(xp);
+	xfrm_pol_put(xp);
 	return err;
 }
 
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] net: af_key: fix refcount leak in pfkey_spdadd()

[Sabrina Dubroca]

2026-06-12, 00:37:43 +0800, WenTao Liang wrote:
> In pfkey_spdadd(), an xfrm policy is allocated via xfrm_policy_alloc()
> with a refcount of 1. On the success path the policy is eventually freed
> by xfrm_pol_put(), which decrements the refcount and calls
> xfrm_policy_destroy() only when it reaches zero. However, all error
> paths directly call xfrm_policy_destroy() without releasing the initial
> reference, leaking the policy object.

Uhm... have you looked at what xfrm_policy_destroy and xfrm_pol_put
do?

-- 
Sabrina