raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 10:00:17 +00:00
Code Issues Projects Releases Wiki Activity

xfrm: make state as DEAD before final put when migrate fails

Browse Source 
xfrm_state_migrate/xfrm_state_clone_and_setup create a new state, and
call xfrm_state_put to destroy it in case of
failure. __xfrm_state_destroy expects the state to be in
XFRM_STATE_DEAD, but we currently don't do that.

Reported-by: syzbot+5cd6299ede4d4f70987b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5cd6299ede4d4f70987b
Fixes: 78347c8c6b ("xfrm: Fix xfrm_state_migrate leak")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
This commit is contained in:
Sabrina Dubroca
2025-10-16 12:39:14 +02:00
committed by Steffen Klassert
parent 10deb69864
commit 5502bc4746
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
net/xfrm/xfrm_state.c
View File

@@ -2074,6 +2074,7 @@ static struct xfrm_state *xfrm_state_clone_and_setup(struct xfrm_state *orig,
return x; return x;
error: error:
x->km.state = XFRM_STATE_DEAD;
xfrm_state_put(x); xfrm_state_put(x);
out: out:
return NULL; return NULL;
@@ -2163,6 +2164,7 @@ struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
return xc; return xc;
error: error:
xc->km.state = XFRM_STATE_DEAD;
xfrm_state_put(xc); xfrm_state_put(xc);
return NULL; return NULL;
} }