[IPSEC]: Fix oops when destroying stillborn states.

diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 4641b35a273ce3498235fe8a23e8571ab806feaf..d15c4ce97edacbcd628de23dd0543ced76499750 100644 (file)
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -308,6 +308,9 @@ static void ah_destroy(struct xfrm_state *x)
 {
        struct ah_data *ahp = x->data;
 
+       if (!ahp)
+               return;
+
        if (ahp->work_icv) {
                kfree(ahp->work_icv);
                ahp->work_icv = NULL;

diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index b5187c936efe394968169a0e3c4e6c38bc4e9fb2..ce9eb8a326f6fc04a834c8420ab3d2eacc3f8645 100644 (file)
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -437,6 +437,9 @@ void esp_destroy(struct xfrm_state *x)
 {
        struct esp_data *esp = x->data;
 
+       if (!esp)
+               return;
+
        if (esp->conf.tfm) {
                crypto_free_tfm(esp->conf.tfm);
                esp->conf.tfm = NULL;

diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index a713530ae557baf5fedc8d564c500b439df6d88f..eb61d3454015e432dcdc3378b894177dc999ba25 100644 (file)
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -336,6 +336,8 @@ static void ipcomp_free_data(struct ipcomp_data *ipcd)
 static void ipcomp_destroy(struct xfrm_state *x)
 {
        struct ipcomp_data *ipcd = x->data;
+       if (!ipcd)
+               return;
        ipcomp_free_data(ipcd);
        kfree(ipcd);
 }
@@ -354,7 +356,6 @@ static int ipcomp_init_state(struct xfrm_state *x, void *args)
        x->props.header_len = sizeof(struct ip_comp_hdr);
        if (x->props.mode)
                x->props.header_len += sizeof(struct iphdr);
-       x->data = ipcd;
 
        ipcd->scratch = kmalloc(IPCOMP_SCRATCH_SIZE, GFP_KERNEL);
        if (!ipcd->scratch)
@@ -373,6 +374,7 @@ static int ipcomp_init_state(struct xfrm_state *x, void *args)
        calg_desc = xfrm_calg_get_byname(x->calg->alg_name);
        BUG_ON(!calg_desc);
        ipcd->threshold = calg_desc->uinfo.comp.threshold;
+       x->data = ipcd;
        err = 0;
 out:
        return err;

diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index c13efb13eaf9c888f0944f2b4b24b0a76191f251..358b3f3f3d1838c6067034fef345a2aa6d736979 100644 (file)
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -444,6 +444,9 @@ static void ah6_destroy(struct xfrm_state *x)
 {
        struct ah_data *ahp = x->data;
 
+       if (!ahp)
+               return;
+
        if (ahp->work_icv) {
                kfree(ahp->work_icv);
                ahp->work_icv = NULL;

diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 992009213c3c9798fb961e549036980f6eecc90b..db09e37225109affe44df5c87ee61e78d1d34785 100644 (file)
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -342,6 +342,9 @@ void esp6_destroy(struct xfrm_state *x)
 {
        struct esp_data *esp = x->data;
 
+       if (!esp)
+               return;
+
        if (esp->conf.tfm) {
                crypto_free_tfm(esp->conf.tfm);
                esp->conf.tfm = NULL;

diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 2101765131c9a68134727f7dceb2f39542de150c..58ddfcab5b84d77772242c3196b56c83122a738c 100644 (file)
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -268,6 +268,8 @@ static void ipcomp6_free_data(struct ipcomp_data *ipcd)
 static void ipcomp6_destroy(struct xfrm_state *x)
 {
        struct ipcomp_data *ipcd = x->data;
+       if (!ipcd)
+               return;
        ipcomp6_free_data(ipcd);
        kfree(ipcd);
 }
@@ -286,7 +288,6 @@ static int ipcomp6_init_state(struct xfrm_state *x, void *args)
        x->props.header_len = sizeof(struct ipv6_comp_hdr);
        if (x->props.mode)
                x->props.header_len += sizeof(struct ipv6hdr);
-       x->data = ipcd;
        
        ipcd->scratch = kmalloc(IPCOMP_SCRATCH_SIZE, GFP_KERNEL);
        if (!ipcd->scratch)
@@ -299,6 +300,7 @@ static int ipcomp6_init_state(struct xfrm_state *x, void *args)
        calg_desc = xfrm_calg_get_byname(x->calg->alg_name);
        BUG_ON(!calg_desc);
        ipcd->threshold = calg_desc->uinfo.comp.threshold;
+       x->data = ipcd;
        err = 0;
 out:
        return err;