tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

xfrm: make state as DEAD before final put when migrate fails

xfrm_state_migrate/xfrm_state_clone_and_setup create a new state, and
call xfrm_state_put to destroy it in case of
failure. __xfrm_state_destroy expects the state to be in
XFRM_STATE_DEAD, but we currently don't do that.

Reported-by: syzbot+5cd6299ede4d4f70987b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5cd6299ede4d4f70987b
Fixes: 78347c8c6b2d ("xfrm: Fix xfrm_state_migrate leak")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

authored by

Sabrina Dubroca and committed by
Steffen Klassert 5502bc47 10deb698

+2
+2
net/xfrm/xfrm_state.c
··· 2074 2074 return x; 2075 2075 2076 2076 error: 2077 + x->km.state = XFRM_STATE_DEAD; 2077 2078 xfrm_state_put(x); 2078 2079 out: 2079 2080 return NULL; ··· 2164 2163 2165 2164 return xc; 2166 2165 error: 2166 + xc->km.state = XFRM_STATE_DEAD; 2167 2167 xfrm_state_put(xc); 2168 2168 return NULL; 2169 2169 }