Commit 7dbac768 authored by Herbert Xu's avatar Herbert Xu Committed by Steffen Klassert
Browse files

xfrm: ipcomp: Free destination pages on acomp errors 



Move the out_free_req label up by a couple of lines so that the
allocated dst SG list gets freed on error as well as success.

Fixes: eb2953d2 ("xfrm: ipcomp: Use crypto_acomp interface")
Cc: stable@kernel.org
Reported-by: default avatarYuan Tan <yuantan098@gmail.com>
Reported-by: default avatarYifan Wu <yifanwucs@gmail.com>
Reported-by: default avatarJuefei Pu <tomapufckgml@gmail.com>
Reported-by: default avatarXin Liu <bird@lzu.edu.cn>
Reported-by: default avatarYilin Zhu <zylzyl2333@gmail.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent 7e2a4f7c

net/xfrm/xfrm_ipcomp.c

+8 −4
Original line number Diff line number Diff line
@@ -51,11 +51,15 @@ static int ipcomp_post_acomp(struct sk_buff *skb, int err, int hlen) 
	struct scatterlist *dsg;

	int len, dlen;



	if (unlikely(err))

		goto out_free_req;

	if (unlikely(!req))

		return err;



	extra = acomp_request_extra(req);

	dsg = extra->sg;



	if (unlikely(err))

		goto out_free_req;



	dlen = req->dlen;



	pskb_trim_unique(skb, 0);
@@ -84,10 +88,10 @@ static int ipcomp_post_acomp(struct sk_buff *skb, int err, int hlen) 
		skb_shinfo(skb)->nr_frags++;

	} while ((dlen -= len));



	for (; dsg; dsg = sg_next(dsg))

out_free_req:

	for (; dsg && sg_page(dsg); dsg = sg_next(dsg))

		__free_page(sg_page(dsg));



out_free_req:

	acomp_request_free(req);

	return err;

}