[src/trunk]: src/sys/netipsec Fix double free: key_setsaval() free's newsav b...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/3f3403289afb
branches:  trunk
changeset: 999599:3f3403289afb
user:      christos <christos%NetBSD.org@localhost>
date:      Wed Jun 12 01:32:30 2019 +0000

description:
Fix double free: key_setsaval() free's newsav by calling key_freesaval()
and key_api_update() calls key_delsav() when key_setsaval() fails which
calls key_freesaval() again...

diffstat:

 sys/netipsec/key.c |  6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diffs (27 lines):

diff -r 60565f31df91 -r 3f3403289afb sys/netipsec/key.c
--- a/sys/netipsec/key.c        Wed Jun 12 00:28:56 2019 +0000
+++ b/sys/netipsec/key.c        Wed Jun 12 01:32:30 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: key.c,v 1.261 2019/01/27 02:08:48 pgoyette Exp $       */
+/*     $NetBSD: key.c,v 1.262 2019/06/12 01:32:30 christos Exp $       */
 /*     $FreeBSD: key.c,v 1.3.2.3 2004/02/14 22:23:23 bms Exp $ */
 /*     $KAME: key.c,v 1.191 2001/06/27 10:46:49 sakane Exp $   */
 
@@ -32,7 +32,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: key.c,v 1.261 2019/01/27 02:08:48 pgoyette Exp $");
+__KERNEL_RCSID(0, "$NetBSD: key.c,v 1.262 2019/06/12 01:32:30 christos Exp $");
 
 /*
  * This code is referred to RFC 2367
@@ -5753,7 +5753,7 @@
 
        error = key_setsaval(newsav, m, mhp);
        if (error) {
-               key_delsav(newsav);
+               kmem_free(newsav, sizeof(*newsav));
                goto error;
        }