Eric Lee / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 1730554f253deb65fe5112c54b2f898d5318a328

Authored by Florian Westphal
Committed by David S. Miller
1 parent adf044c877
Exists in master and in 39 other branches 8mp-imx_5.4.70_2.3.0, 8qm-imx_5.4.70_2.3.0, emb_imx_lf-5.15.y, emb_lf-6.1.y, imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, imx_4.1.15_1.0.0_ga, pitx_8mp_lf-5.10.y, rt-smarc-imx_4.1.15_1.0.0_ga, rt_linux_5.15.71, smarc-8m-android-11.0.0_2.0.0, smarc-imx6_4.14.98_2.0.0_ga, smarc-imx6_4.9.88_2.0.0_ga, smarc-imx7_4.14.98_2.0.0_ga, smarc-imx7_4.9.11_1.0.0_ga, smarc-imx7_4.9.88_2.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-imx_4.1.15_1.0.0_ga, smarc-imx_4.9.11_1.0.0_ga, smarc-imx_4.9.51_imx8m_ga, smarc-imx_4.9.88_2.0.0_ga, smarc-m6.0.1_2.1.0-ga, smarc-n7.1.2_2.0.0-ga, smarc-rel_imx_4.1.15_1.2.0_ga, smarc_8m_00d0_imx_4.14.98_2.0.0_ga, smarc_8m_imx_4.14.78_1.0.0_ga, smarc_8m_imx_4.14.98_2.0.0_ga, smarc_8m_imx_4.19.35_1.1.0, smarc_8mm_imx_4.14.78_1.0.0_ga, smarc_8mm_imx_4.14.98_2.0.0_ga, smarc_8mm_imx_4.19.35_1.1.0, smarc_8mm_imx_5.4.24_2.1.0, smarc_8mp_lf-5.10.y, smarc_8mq_imx_5.4.24_2.1.0, smarc_8mq_lf-5.10.y, smarc_imx_lf-5.15.y

ipv6: syncookies: free reqsk on xfrm_lookup error 

cookie_v6_check() did not call reqsk_free() if xfrm_lookup() fails,
leaking the request sock.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 1 changed file with 11 additions and 11 deletions Side-by-side Diff

net/ipv6/syncookies.c
Diff comments   View file @ 1730554
... ... @@ -199,10 +199,8 @@
199 199 ireq6 = inet6_rsk(req);
200 200 treq = tcp_rsk(req);
201 201  
202   - if (security_inet_conn_request(sk, skb, req)) {
203   - reqsk_free(req);
204   - goto out;
205   - }
  202 + if (security_inet_conn_request(sk, skb, req))
  203 + goto out_free;
206 204  
207 205 req->mss = mss;
208 206 ireq->rmt_port = th->source;
209 207  
... ... @@ -255,14 +253,13 @@
255 253 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
256 254 fl.fl_ip_sport = inet_sk(sk)->sport;
257 255 security_req_classify_flow(req, &fl);
258   - if (ip6_dst_lookup(sk, &dst, &fl)) {
259   - reqsk_free(req);
260   - goto out;
261   - }
  256 + if (ip6_dst_lookup(sk, &dst, &fl))
  257 + goto out_free;
  258 +
262 259 if (final_p)
263 260 ipv6_addr_copy(&fl.fl6_dst, final_p);
264 261 if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
265   - goto out;
  262 + goto out_free;
266 263 }
267 264  
268 265 req->window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
... ... @@ -273,7 +270,10 @@
273 270 ireq->rcv_wscale = rcv_wscale;
274 271  
275 272 ret = get_cookie_sock(sk, skb, req, dst);
276   -
277   -out: return ret;
  273 +out:
  274 + return ret;
  275 +out_free:
  276 + reqsk_free(req);
  277 + return NULL;
278 278 }