Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 05238204 authored by Timo Teras's avatar Timo Teras Committed by David S. Miller
Browse files

af_key: Free dumping state on socket close 



Fix a xfrm_{state,policy}_walk leak if pfkey socket is closed while
dumping is on-going.

Signed-off-by: default avatarTimo Teras <timo.teras@iki.fi>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5dc121e9

net/key/af_key.c

+19 −11
Original line number Diff line number Diff line
@@ -73,22 +73,18 @@ static int pfkey_can_dump(struct sock *sk) 
	return 0;

}



static int pfkey_do_dump(struct pfkey_sock *pfk)

static void pfkey_terminate_dump(struct pfkey_sock *pfk)

{

	int rc;



	rc = pfk->dump.dump(pfk);

	if (rc == -ENOBUFS)

		return 0;



	if (pfk->dump.dump) {

		pfk->dump.done(pfk);

		pfk->dump.dump = NULL;

		pfk->dump.done = NULL;

	return rc;

	}

}



static void pfkey_sock_destruct(struct sock *sk)

{

	pfkey_terminate_dump(pfkey_sk(sk));

	skb_queue_purge(&sk->sk_receive_queue);



	if (!sock_flag(sk, SOCK_DEAD)) {
@@ -310,6 +306,18 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation, 
	return err;

}



static int pfkey_do_dump(struct pfkey_sock *pfk)

{

	int rc;



	rc = pfk->dump.dump(pfk);

	if (rc == -ENOBUFS)

		return 0;



	pfkey_terminate_dump(pfk);

	return rc;

}



static inline void pfkey_hdr_dup(struct sadb_msg *new, struct sadb_msg *orig)

{

	*new = *orig;