diff options
| author |   Mathias Krause <minipli@googlemail.com> | 2018-11-21 21:09:23 +0100 |
|---|---|---|
| committer |   Steffen Klassert <steffen.klassert@secunet.com> | 2018-11-23 07:51:32 +0100 |
| commit | 4a135e538962cb00a9667c82e7d2b9e4d7cd7177 (patch) | |
| tree | ebbf0cd2aec6fe1a4c01fd871f5b3263a50711b0 /net | |
| parent | xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force clears the dst_entry. (diff) | |
| download | linux-dev-4a135e538962cb00a9667c82e7d2b9e4d7cd7177.tar.xz linux-dev-4a135e538962cb00a9667c82e7d2b9e4d7cd7177.zip | |
xfrm_user: fix freeing of xfrm states on acquire
Commit 565f0fa902b6 ("xfrm: use a dedicated slab cache for struct
xfrm_state") moved xfrm state objects to use their own slab cache.
However, it missed to adapt xfrm_user to use this new cache when
freeing xfrm states.
Fix this by introducing and make use of a new helper for freeing
xfrm_state objects.
Fixes: 565f0fa902b6 ("xfrm: use a dedicated slab cache for struct xfrm_state")
Reported-by: Pan Bian <bianpan2016@163.com>
Cc: <stable@vger.kernel.org> # v4.18+
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to '')
| -rw-r--r-- | net/xfrm/xfrm_state.c | 8 | ||||
| -rw-r--r-- | net/xfrm/xfrm_user.c | 4 |
2 files changed, 9 insertions, 3 deletions
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index 12cdb350c456..cc0203efb584 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -426,6 +426,12 @@ static void xfrm_put_mode(struct xfrm_mode *mode) module_put(mode->owner); } +void xfrm_state_free(struct xfrm_state *x) +{ + kmem_cache_free(xfrm_state_cache, x); +} +EXPORT_SYMBOL(xfrm_state_free); + static void xfrm_state_gc_destroy(struct xfrm_state *x) { tasklet_hrtimer_cancel(&x->mtimer); @@ -452,7 +458,7 @@ static void xfrm_state_gc_destroy(struct xfrm_state *x) } xfrm_dev_state_free(x); security_xfrm_state_free(x); - kmem_cache_free(xfrm_state_cache, x); + xfrm_state_free(x); } static void xfrm_state_gc_task(struct work_struct *work) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index ca7a207b81a9..683080172655 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -2288,13 +2288,13 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh, } - kfree(x); + xfrm_state_free(x); kfree(xp); return 0; free_state: - kfree(x); + xfrm_state_free(x); nomem: return err; } |