Commit 3c7c6e08 authored Nov 10, 2020 by Yu Kuai Committed by Lee Jones Feb 01, 2023

BACKPORT: net: xfrm: fix memory leak in xfrm_user_policy()



if xfrm_get_translator() failed, xfrm_user_policy() return without
freeing 'data', which is allocated in memdup_sockptr().

Bug: 254441685
Fixes: 96392ee5a13b ("xfrm/compat: Translate 32-bit user_policy from sockptr")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
(cherry picked from commit 48f486e13ffdb49fbb9b38c21d0e108ed60ab1a2)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I0744588549ae7ac9d11ffa6ceec4beb1962e6b4a

parent 63d464fe

net/xfrm/xfrm_state.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -2213,8 +2213,10 @@ int xfrm_user_policy(struct sock sk, int optname, u8 __user optval, int optlen
		if (in_compat_syscall()) {
		struct xfrm_translator *xtr = xfrm_get_translator();

		if (!xtr)
		if (!xtr) {
		kfree(data);
		return -EOPNOTSUPP;
		}

		err = xtr->xlate_user_policy_sockptr(&data, optlen);
		xfrm_put_translator(xtr);