diff options
| author | Xin Long <lucien.xin@gmail.com> | 2020-04-10 17:08:24 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-06-03 08:23:29 +0200 |
| commit | 1876813d39bf2f5e6dfa5c332fd3bf688bdc254d (patch) | |
| tree | 7eaf8b3e3c7f0ba507bef567584cfa0f1443474f | |
| parent | 751e75cce8a13354151b55f2903b3127cfc2c199 (diff) | |
| download | linux-1876813d39bf2f5e6dfa5c332fd3bf688bdc254d.tar.gz linux-1876813d39bf2f5e6dfa5c332fd3bf688bdc254d.tar.bz2 linux-1876813d39bf2f5e6dfa5c332fd3bf688bdc254d.zip | |
xfrm: remove the xfrm_state_put call becofe going to out_reset
commit db87668ad1e4917cfe04e217307ba6ed9390716e upstream.
This xfrm_state_put call in esp4/6_gro_receive() will cause
double put for state, as in out_reset path secpath_reset()
will put all states set in skb sec_path.
So fix it by simply remove the xfrm_state_put call.
Fixes: 6ed69184ed9c ("xfrm: Reset secpath in xfrm failure")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/ipv4/esp4_offload.c | 4 | ||||
| -rw-r--r-- | net/ipv6/esp6_offload.c | 4 |
2 files changed, 2 insertions, 6 deletions
diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c index e2e219c7854a..25c8ba6732df 100644 --- a/net/ipv4/esp4_offload.c +++ b/net/ipv4/esp4_offload.c @@ -63,10 +63,8 @@ static struct sk_buff *esp4_gro_receive(struct list_head *head, sp->olen++; xo = xfrm_offload(skb); - if (!xo) { - xfrm_state_put(x); + if (!xo) goto out_reset; - } } xo->flags |= XFRM_GRO; diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c index fd535053245b..428e5e4bf822 100644 --- a/net/ipv6/esp6_offload.c +++ b/net/ipv6/esp6_offload.c @@ -85,10 +85,8 @@ static struct sk_buff *esp6_gro_receive(struct list_head *head, sp->olen++; xo = xfrm_offload(skb); - if (!xo) { - xfrm_state_put(x); + if (!xo) goto out_reset; - } } xo->flags |= XFRM_GRO; |