Xin Xiong 18e6b6e255 xfrm: fix refcount leak in __xfrm_policy_check() ...

[ Upstream commit 9c9cb23e00ddf45679b21b4dacc11d1ae7961ebe ]

The issue happens on an error path in __xfrm_policy_check(). When the
fetching process of the object `pols[1]` fails, the function simply
returns 0, forgetting to decrement the reference count of `pols[0]`,
which is incremented earlier by either xfrm_sk_policy_lookup() or
xfrm_policy_lookup(). This may result in memory leaks.

Fix it by decreasing the reference count of `pols[0]` in that path.

Fixes: 134b0fc544ba ("IPsec: propagate security module errors up from flow_cache_lookup")
Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2022-09-05 10:23:54 +02:00

..

Kconfig

ipsec: select crypto ciphers for xfrm_algo

2019-08-04 09:33:20 +02:00

Makefile

…

xfrm_algo.c

xfrm: use IS_ENABLED() instead of checking for built-in or module

2016-09-10 21:19:11 -07:00

xfrm_hash.c

…

xfrm_hash.h

xfrm: hash prefixed policies based on preflen thresholds

2014-09-02 13:29:44 +02:00

xfrm_input.c

xfrm: Fix oops in xfrm_replay_advance_bmp

2021-02-03 23:19:51 +01:00

xfrm_ipcomp.c

net: xfrm: use preempt-safe this_cpu_read() in ipcomp_alloc_tfms()

2018-04-08 12:12:49 +02:00

xfrm_output.c

xfrm: fix a NULL-ptr deref in xfrm_local_error

2020-06-03 08:16:44 +02:00

xfrm_policy.c

xfrm: fix refcount leak in __xfrm_policy_check()

2022-09-05 10:23:54 +02:00

xfrm_proc.c

proc: Reduce cache miss in xfrm_statistics_seq_show

2016-09-30 01:50:45 -04:00

xfrm_replay.c

xfrm: constify xfrm_replay structures

2016-08-10 11:18:49 +02:00

xfrm_state.c

xfrm: Fix xfrm migrate issues when address family changes

2022-03-23 09:00:33 +01:00

xfrm_sysctl.c

net: xfrm: Change u32 sysctl entries to use proc_douintvec

2016-09-07 23:17:53 -07:00

xfrm_user.c

xfrm: policy: match with both mark and mask on user interfaces

2022-04-20 09:06:44 +02:00