[XFRM]: Fix two bugs in xfrm_lookup()

- the found or allocated xfrm_states are not passed correctly to
  xfrm_bundle_create (and to the subsequent frees in case of create
  failing) if the first xfrm_tmpl_resolve failed and the second one
  succeeded.
- error handling is wrong.

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 0f970906c9efaaf6bb069bcbfb1a8b93b6ec65b8..bc2250dec0a35917e7010aebe18a0fc9a37d9301 100644 (file)
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -783,25 +783,27 @@ restart:
 
                                __set_task_state(tsk, TASK_INTERRUPTIBLE);
                                add_wait_queue(&km_waitq, &wait);
-                               err = xfrm_tmpl_resolve(policy, fl, xfrm, family);
-                               if (err == -EAGAIN)
+                               nx = xfrm_tmpl_resolve(policy, fl, xfrm, family);
+                               if (nx == -EAGAIN)
                                        schedule();
                                __set_task_state(tsk, TASK_RUNNING);
                                remove_wait_queue(&km_waitq, &wait);
 
-                               if (err == -EAGAIN && signal_pending(current)) {
+                               if (nx == -EAGAIN && signal_pending(current)) {
                                        err = -ERESTART;
                                        goto error;
                                }
-                               if (err == -EAGAIN ||
+                               if (nx == -EAGAIN ||
                                    genid != atomic_read(&flow_cache_genid)) {
                                        xfrm_pol_put(policy);
                                        goto restart;
                                }
+                               err = nx;
                        }
-                       if (err)
+                       if (err < 0)
                                goto error;
-               } else if (nx == 0) {
+               }
+               if (nx == 0) {
                        /* Flow passes not transformed. */
                        xfrm_pol_put(policy);
                        return 0;