summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSteffen Klassert <steffen.klassert@secunet.com>2011-03-15 21:09:32 +0000
committerDavid S. Miller <davem@davemloft.net>2011-03-27 17:55:01 -0700
commite433430a0ca9cc1b851a83ac3b305e955b64880a (patch)
tree129e0c5db7e5643352ac55a920b5d6c5ef65fb66
parent3bc07321ccc236f693ce1b6a8786f0a2e38bb87e (diff)
downloadlinux-3.10-e433430a0ca9cc1b851a83ac3b305e955b64880a.tar.gz
linux-3.10-e433430a0ca9cc1b851a83ac3b305e955b64880a.tar.bz2
linux-3.10-e433430a0ca9cc1b851a83ac3b305e955b64880a.zip
dst: Clone child entry in skb_dst_pop
We clone the child entry in skb_dst_pop before we call skb_dst_drop(). Otherwise we might kill the child right before we return it to the caller. Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--include/net/dst.h2
-rw-r--r--net/xfrm/xfrm_output.c2
2 files changed, 2 insertions, 2 deletions
diff --git a/include/net/dst.h b/include/net/dst.h
index 2a46cbaef92..75b95df4afe 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -345,7 +345,7 @@ static inline void skb_tunnel_rx(struct sk_buff *skb, struct net_device *dev)
static inline struct dst_entry *skb_dst_pop(struct sk_buff *skb)
{
- struct dst_entry *child = skb_dst(skb)->child;
+ struct dst_entry *child = dst_clone(skb_dst(skb)->child);
skb_dst_drop(skb);
return child;
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 8f3f0eedc5a..47bacd8c025 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -96,7 +96,7 @@ resume:
err = -EHOSTUNREACH;
goto error_nolock;
}
- skb_dst_set(skb, dst_clone(dst));
+ skb_dst_set(skb, dst);
x = dst->xfrm;
} while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL));