diff options
| author | Tushar Gohad <tgohad@mvista.com> | 2011-07-07 15:38:52 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2011-07-08 08:58:42 -0700 |
| commit | 8fcbc63701b01e913e6a13937f765fabf9c969c5 (patch) | |
| tree | eaed81a25f362299b29de4731ca02289043b8cc2 /net/xfrm | |
| parent | f8d9605243280f1870dd2c6c37a735b925c15f3c (diff) | |
| download | linux-8fcbc63701b01e913e6a13937f765fabf9c969c5.tar.gz linux-8fcbc63701b01e913e6a13937f765fabf9c969c5.tar.bz2 linux-8fcbc63701b01e913e6a13937f765fabf9c969c5.zip | |
XFRM: Fix memory leak in xfrm_state_update
Upon "ip xfrm state update ..", xfrm_add_sa() takes an extra reference on
the user-supplied SA and forgets to drop the reference when
xfrm_state_update() returns 0. This leads to a memory leak as the
parameter SA is never freed. This change attempts to fix the leak by
calling __xfrm_state_put() when xfrm_state_update() updates a valid SA
(err = 0). The parameter SA is added to the gc list when the final
reference is dropped by xfrm_add_sa() upon completion.
Signed-off-by: Tushar Gohad <tgohad@mvista.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/xfrm')
| -rw-r--r-- | net/xfrm/xfrm_state.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index d70f85eb7864..9414b9c5b1e4 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -1345,6 +1345,8 @@ out: xfrm_state_check_expire(x1); err = 0; + x->km.state = XFRM_STATE_DEAD; + __xfrm_state_put(x); } spin_unlock_bh(&x1->lock); |