提交 8fcbc637 编写于 作者: T Tushar Gohad 提交者: David S. Miller

XFRM: Fix memory leak in xfrm_state_update

Upon "ip xfrm state update ..", xfrm_add_sa() takes an extra reference on
the user-supplied SA and forgets to drop the reference when
xfrm_state_update() returns 0.  This leads to a memory leak as the
parameter SA is never freed.  This change attempts to fix the leak by
calling __xfrm_state_put() when xfrm_state_update() updates a valid SA
(err = 0).  The parameter SA is added to the gc list when the final
reference is dropped by xfrm_add_sa() upon completion.
Signed-off-by: NTushar Gohad <tgohad@mvista.com>
Acked-by: NHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 f8d96052
无相关合并请求
......@@ -1345,6 +1345,8 @@ int xfrm_state_update(struct xfrm_state *x)
xfrm_state_check_expire(x1);
err = 0;
x->km.state = XFRM_STATE_DEAD;
__xfrm_state_put(x);
}
spin_unlock_bh(&x1->lock);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册
反馈
建议
客服 返回
顶部