Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 75b8c133 authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller
Browse files

[IPSEC]: Fix potential dst leak in xfrm_lookup 



If we get an error during the actual policy lookup we don't free the
original dst while the caller expects us to always free the original
dst in case of error.

This patch fixes that.

Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 3f03e387

net/xfrm/xfrm_policy.c

+6 −3
Original line number Diff line number Diff line
@@ -1318,8 +1318,9 @@ int __xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl, 


	if (sk && sk->sk_policy[XFRM_POLICY_OUT]) {

		policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);

		err = PTR_ERR(policy);

		if (IS_ERR(policy))

			return PTR_ERR(policy);

			goto dropdst;

	}



	if (!policy) {
@@ -1330,8 +1331,9 @@ int __xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl, 


		policy = flow_cache_lookup(fl, dst_orig->ops->family,

					   dir, xfrm_policy_lookup);

		err = PTR_ERR(policy);

		if (IS_ERR(policy))

			return PTR_ERR(policy);

			goto dropdst;

	}



	if (!policy)
@@ -1501,8 +1503,9 @@ int __xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl, 
	return 0;



error:

	dst_release(dst_orig);

	xfrm_pols_put(pols, npols);

dropdst:

	dst_release(dst_orig);

	*dst_p = NULL;

	return err;

}