From: Zilin Guan <zilin@seu.edu.cn>
Date: Thu, 6 Nov 2025 14:45:11 +0000 (+0000)
Subject: net/handshake: Fix memory leak in tls_handshake_accept()
X-Git-Tag: v6.18-rc6~31^2~16
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3072f00bba764082fa41b3c3a2a7b013335353d2;p=thirdparty%2Flinux.git

net/handshake: Fix memory leak in tls_handshake_accept()

In tls_handshake_accept(), a netlink message is allocated using
genlmsg_new(). In the error handling path, genlmsg_cancel() is called
to cancel the message construction, but the message itself is not freed.
This leads to a memory leak.

Fix this by calling nlmsg_free() in the error path after genlmsg_cancel()
to release the allocated memory.

Fixes: 2fd5532044a89 ("net/handshake: Add a kernel API for requesting a TLSv1.3 handshake")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
Link: https://patch.msgid.link/20251106144511.3859535-1-zilin@seu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---

diff --git a/net/handshake/tlshd.c b/net/handshake/tlshd.c
index 081093dfd5533..8f9532a15f43f 100644
--- a/net/handshake/tlshd.c
+++ b/net/handshake/tlshd.c
@@ -259,6 +259,7 @@ static int tls_handshake_accept(struct handshake_req *req,
 
 out_cancel:
 	genlmsg_cancel(msg, hdr);
+	nlmsg_free(msg);
 out:
 	return ret;
 }