xfrm: ipcomp: Free destination pages on acomp errors

Move the out_free_req label up by a couple of lines so that the
allocated dst SG list gets freed on error as well as success.

Fixes: eb2953d26971 ("xfrm: ipcomp: Use crypto_acomp interface")
Cc: stable@kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Reported-by: Yilin Zhu <zylzyl2333@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c
index 5f38dff16177c2cfe5e5b396eec39ecf1775b77a..671d48f8c937498db4e80da1f52a8bbaa05eeac1 100644 (file)
--- a/net/xfrm/xfrm_ipcomp.c
+++ b/net/xfrm/xfrm_ipcomp.c
@@ -51,11 +51,15 @@ static int ipcomp_post_acomp(struct sk_buff *skb, int err, int hlen)
        struct scatterlist *dsg;
        int len, dlen;
 
-       if (unlikely(err))
-               goto out_free_req;
+       if (unlikely(!req))
+               return err;
 
        extra = acomp_request_extra(req);
        dsg = extra->sg;
+
+       if (unlikely(err))
+               goto out_free_req;
+
        dlen = req->dlen;
 
        pskb_trim_unique(skb, 0);
@@ -84,10 +88,10 @@ static int ipcomp_post_acomp(struct sk_buff *skb, int err, int hlen)
                skb_shinfo(skb)->nr_frags++;
        } while ((dlen -= len));
 
-       for (; dsg; dsg = sg_next(dsg))
+out_free_req:
+       for (; dsg && sg_page(dsg); dsg = sg_next(dsg))
                __free_page(sg_page(dsg));
 
-out_free_req:
        acomp_request_free(req);
        return err;
 }