Commit 8fcbc637 authored Jul 07, 2011 by Tushar Gohad Committed by David S. Miller Jul 08, 2011

XFRM: Fix memory leak in xfrm_state_update



Upon "ip xfrm state update ..", xfrm_add_sa() takes an extra reference on
the user-supplied SA and forgets to drop the reference when
xfrm_state_update() returns 0.  This leads to a memory leak as the
parameter SA is never freed.  This change attempts to fix the leak by
calling __xfrm_state_put() when xfrm_state_update() updates a valid SA
(err = 0).  The parameter SA is added to the gc list when the final
reference is dropped by xfrm_add_sa() upon completion.

Signed-off-by: Tushar Gohad <tgohad@mvista.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent f8d96052

net/xfrm/xfrm_state.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -1345,6 +1345,8 @@ int xfrm_state_update(struct xfrm_state *x)
		xfrm_state_check_expire(x1);

		err = 0;
		x->km.state = XFRM_STATE_DEAD;
		__xfrm_state_put(x);
		}
		spin_unlock_bh(&x1->lock);