]> git.hungrycats.org Git - linux/commitdiff
[IPSEC]: Fix ref counting in __xfrmN_bundle_create().
authorHerbert Xu <herbert@gondor.apana.org.au>
Sat, 29 May 2004 05:46:04 +0000 (22:46 -0700)
committerDavid S. Miller <davem@nuts.davemloft.net>
Sat, 29 May 2004 05:46:04 +0000 (22:46 -0700)
net/ipv4/xfrm4_policy.c
net/ipv6/xfrm6_policy.c
net/xfrm/xfrm_policy.c

index c70dde74777b5ef1b815a0ceb9b79b80865d011c..a05bd39a72c6757a0ed5782b7bec78b45b172b92 100644 (file)
@@ -90,7 +90,6 @@ __xfrm4_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
                        goto error;
                }
 
-               dst1->xfrm = xfrm[i];
                if (!dst)
                        dst = dst1;
                else {
@@ -120,10 +119,12 @@ __xfrm4_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
                dst_hold(&rt->u.dst);
        }
        dst_prev->child = &rt->u.dst;
+       i = 0;
        for (dst_prev = dst; dst_prev != &rt->u.dst; dst_prev = dst_prev->child) {
                struct xfrm_dst *x = (struct xfrm_dst*)dst_prev;
                x->u.rt.fl = *fl;
 
+               dst_prev->xfrm = xfrm[i++];
                dst_prev->dev = rt->u.dst.dev;
                if (rt->u.dst.dev)
                        dev_hold(rt->u.dst.dev);
index 5e598b3519e952149019a78240be2f075e80f128..1041ef9524af50935f638f4c0feedd868616e4b0 100644 (file)
@@ -107,7 +107,6 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
                        goto error;
                }
 
-               dst1->xfrm = xfrm[i];
                if (!dst)
                        dst = dst1;
                else {
@@ -139,9 +138,11 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
                dst_hold(&rt->u.dst);
        }
        dst_prev->child = &rt->u.dst;
+       i = 0;
        for (dst_prev = dst; dst_prev != &rt->u.dst; dst_prev = dst_prev->child) {
                struct xfrm_dst *x = (struct xfrm_dst*)dst_prev;
 
+               dst_prev->xfrm = xfrm[i++];
                dst_prev->dev = rt->u.dst.dev;
                if (rt->u.dst.dev)
                        dev_hold(rt->u.dst.dev);
index 5bfbdc35b5f9b584b23e6e9f767067a2e227b31b..2e60c843ff29baf4d87f5acb6b1594d212df079b 100644 (file)
@@ -1017,6 +1017,8 @@ static int stale_bundle(struct dst_entry *dst)
 
 static void xfrm_dst_destroy(struct dst_entry *dst)
 {
+       if (!dst->xfrm)
+               return;
        xfrm_state_put(dst->xfrm);
        dst->xfrm = NULL;
 }