af_key: fix leaks in key_pol_get_resp and dump_sp.
In both functions, if pfkey_xfrm_policy2msg failed we leaked the newly
allocated sk_buff. Free it on error.
Fixes: 55569ce256
("Fix conversion between IPSEC_MODE_xxx and XFRM_MODE_xxx.")
Reported-by: syzbot+4f0529365f7f2208d9f0@syzkaller.appspotmail.com
Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
This commit is contained in:
parent
b38ff4075a
commit
7c80eb1c7e
@ -2442,8 +2442,10 @@ static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, const struc
|
||||
goto out;
|
||||
}
|
||||
err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
|
||||
if (err < 0)
|
||||
if (err < 0) {
|
||||
kfree_skb(out_skb);
|
||||
goto out;
|
||||
}
|
||||
|
||||
out_hdr = (struct sadb_msg *) out_skb->data;
|
||||
out_hdr->sadb_msg_version = hdr->sadb_msg_version;
|
||||
@ -2694,8 +2696,10 @@ static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr)
|
||||
return PTR_ERR(out_skb);
|
||||
|
||||
err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
|
||||
if (err < 0)
|
||||
if (err < 0) {
|
||||
kfree_skb(out_skb);
|
||||
return err;
|
||||
}
|
||||
|
||||
out_hdr = (struct sadb_msg *) out_skb->data;
|
||||
out_hdr->sadb_msg_version = pfk->dump.msg_version;
|
||||
|
Loading…
Reference in New Issue
Block a user