[IPSEC]: xfrm_alloc_spi always succeeds on non-trivial range

xfrm_alloc_spi will always succeed if minspi < maxspi, even if
minspi + 1 == maxspi.  If the range is already occupied this
will obviously lead to breakage.

Of course this is very unlikely to occur in reality due to the
size of the range.  Although with IPCOMP it might actually happen
on a very large server.

The fix is obivous.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@redhat.com>

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 1f57379203fd859492bd6f8622000893bfc53c2d..f45fa55c2c6c57f429bed827540c7a4a07c6d593 100644 (file)
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -624,11 +624,12 @@ xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi)
                for (h=0; h<maxspi-minspi+1; h++) {
                        spi = minspi + net_random()%(maxspi-minspi+1);
                        x0 = xfrm_state_lookup(&x->id.daddr, htonl(spi), x->id.proto, x->props.family);
-                       if (x0 == NULL)
+                       if (x0 == NULL) {
+                               x->id.spi = htonl(spi);
                                break;
+                       }
                        xfrm_state_put(x0);
                }
-               x->id.spi = htonl(spi);
        }
        if (x->id.spi) {
                spin_lock_bh(&xfrm_state_lock);