commit ab412cdc07e19a872037e4034caa522398c4be07
author Benoît Ganne <bganne@cisco.com> Tue Jan 03 18:35:04 2023 +0100
committer Neale Ranns <neale@graphiant.com> Mon Feb 06 03:35:48 2023 +0000
tree ca3567b62b86fa890b0b89135c6ad51987898c94
parent af2e88d964ff8bd8eca30c182ab00e178213c1d4

ipsec: fix async crypto linked keys memory leak

Type: fix

Change-Id: I7bd2696541c8b3824837e187de096fdde19b2c44
Signed-off-by: Benoît Ganne <bganne@cisco.com>

src/vnet/ipsec/ipsec_sa.c

diff --git a/src/vnet/ipsec/ipsec_sa.c b/src/vnet/ipsec/ipsec_sa.c
index 295323b..12f8ece 100644
--- a/src/vnet/ipsec/ipsec_sa.c
+++ b/src/vnet/ipsec/ipsec_sa.c
@@ -484,7 +484,12 @@
   (void) ipsec_call_add_del_callbacks (im, sa, sa_index, 0);
 
   if (ipsec_sa_is_set_IS_ASYNC (sa))
-    vnet_crypto_request_async_mode (0);
+    {
+      vnet_crypto_request_async_mode (0);
+      if (!ipsec_sa_is_set_IS_AEAD (sa))
+	vnet_crypto_key_del (vm, sa->async_op_data.linked_key_index);
+    }
+
   if (ipsec_sa_is_set_UDP_ENCAP (sa) && ipsec_sa_is_set_IS_INBOUND (sa))
     ipsec_unregister_udp_port (clib_net_to_host_u16 (sa->udp_hdr.dst_port),
 			       !ipsec_sa_is_set_IS_TUNNEL_V6 (sa));