aboutsummaryrefslogtreecommitdiffstats
path: root/net/xfrm/xfrm_policy.c
diff options
context:
space:
mode:
authorHerbert Xu <herbert@gondor.apana.org.au>2007-12-11 07:38:08 -0500
committerDavid S. Miller <davem@davemloft.net>2007-12-11 07:38:08 -0500
commit75b8c133267053c9986a7c8db5131f0e7349e806 (patch)
tree264a44a1882196c894f1af84baf7fbba7698678c /net/xfrm/xfrm_policy.c
parent3f03e387893ffa07a4d5dac96772f9db3221a185 (diff)
[IPSEC]: Fix potential dst leak in xfrm_lookup
If we get an error during the actual policy lookup we don't free the original dst while the caller expects us to always free the original dst in case of error. This patch fixes that. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/xfrm/xfrm_policy.c')
-rw-r--r--net/xfrm/xfrm_policy.c9
1 files changed, 6 insertions, 3 deletions
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 9a4cf2e45a1..b91b16671c1 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1318,8 +1318,9 @@ restart:
1318 1318
1319 if (sk && sk->sk_policy[XFRM_POLICY_OUT]) { 1319 if (sk && sk->sk_policy[XFRM_POLICY_OUT]) {
1320 policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl); 1320 policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
1321 err = PTR_ERR(policy);
1321 if (IS_ERR(policy)) 1322 if (IS_ERR(policy))
1322 return PTR_ERR(policy); 1323 goto dropdst;
1323 } 1324 }
1324 1325
1325 if (!policy) { 1326 if (!policy) {
@@ -1330,8 +1331,9 @@ restart:
1330 1331
1331 policy = flow_cache_lookup(fl, dst_orig->ops->family, 1332 policy = flow_cache_lookup(fl, dst_orig->ops->family,
1332 dir, xfrm_policy_lookup); 1333 dir, xfrm_policy_lookup);
1334 err = PTR_ERR(policy);
1333 if (IS_ERR(policy)) 1335 if (IS_ERR(policy))
1334 return PTR_ERR(policy); 1336 goto dropdst;
1335 } 1337 }
1336 1338
1337 if (!policy) 1339 if (!policy)
@@ -1501,8 +1503,9 @@ restart:
1501 return 0; 1503 return 0;
1502 1504
1503error: 1505error:
1504 dst_release(dst_orig);
1505 xfrm_pols_put(pols, npols); 1506 xfrm_pols_put(pols, npols);
1507dropdst:
1508 dst_release(dst_orig);
1506 *dst_p = NULL; 1509 *dst_p = NULL;
1507 return err; 1510 return err;
1508} 1511}