Commit 96f887a6 authored by Hagar Hemdan's avatar Hagar Hemdan Committed by Steffen Klassert
Browse files

net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP 



xmit() functions should consume skb or return error codes in error
paths.
When the configuration "CONFIG_INET_ESPINTCP" is not set, the
implementation of the function "esp_output_tail_tcp" violates this rule.
The function frees the skb and returns the error code.
This change removes the kfree_skb from both functions, for both
esp4 and esp6.
WARN_ON is added because esp_output_tail_tcp() should never be called if
CONFIG_INET_ESPINTCP is not set.

This bug was discovered and resolved using Coverity Static Analysis
Security Testing (SAST) by Synopsys, Inc.

Fixes: e27cca96 ("xfrm: add espintcp (RFC 8229)")
Signed-off-by: default avatarHagar Hemdan <hagarhem@amazon.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent 9c91c7fa

net/ipv4/esp4.c

+1 −2
Original line number Diff line number Diff line
@@ -239,8 +239,7 @@ static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb) 
#else

static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb)

{

	kfree_skb(skb);



	WARN_ON(1);

	return -EOPNOTSUPP;

}

#endif

net/ipv6/esp6.c

+1 −2
Original line number Diff line number Diff line
@@ -256,8 +256,7 @@ static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb) 
#else

static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb)

{

	kfree_skb(skb);



	WARN_ON(1);

	return -EOPNOTSUPP;

}

#endif