diff options
| author | Steffen Klassert <steffen.klassert@secunet.com> | 2011-03-15 21:08:28 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2011-03-27 17:55:01 -0700 |
| commit | 3bc07321ccc236f693ce1b6a8786f0a2e38bb87e (patch) | |
| tree | b20b9171ccfb5eb869d3f4c5f005eb7c221b9f70 | |
| parent | 1fbc78439291627642517f15b9b91f3125588143 (diff) | |
| download | linux-3.10-3bc07321ccc236f693ce1b6a8786f0a2e38bb87e.tar.gz linux-3.10-3bc07321ccc236f693ce1b6a8786f0a2e38bb87e.tar.bz2 linux-3.10-3bc07321ccc236f693ce1b6a8786f0a2e38bb87e.zip | |
xfrm: Force a dst refcount before entering the xfrm type handlers
Crypto requests might return asynchronous. In this case we leave
the rcu protected region, so force a refcount on the skb's
destination entry before we enter the xfrm type input/output
handlers.
This fixes a crash when a route is deleted whilst sending IPsec
data that is transformed by an asynchronous algorithm.
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/xfrm/xfrm_input.c | 2 | ||||
| -rw-r--r-- | net/xfrm/xfrm_output.c | 2 |
2 files changed, 4 insertions, 0 deletions
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c index 872065ca7f8..341cd1189f8 100644 --- a/net/xfrm/xfrm_input.c +++ b/net/xfrm/xfrm_input.c @@ -190,6 +190,8 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) XFRM_SKB_CB(skb)->seq.input.low = seq; XFRM_SKB_CB(skb)->seq.input.hi = seq_hi; + skb_dst_force(skb); + nexthdr = x->type->input(x, skb); if (nexthdr == -EINPROGRESS) diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c index 1aba03f449c..8f3f0eedc5a 100644 --- a/net/xfrm/xfrm_output.c +++ b/net/xfrm/xfrm_output.c @@ -78,6 +78,8 @@ static int xfrm_output_one(struct sk_buff *skb, int err) spin_unlock_bh(&x->lock); + skb_dst_force(skb); + err = x->type->output(x, skb); if (err == -EINPROGRESS) goto out_exit; |