xfrm: Refcount destination entry on xfrm_lookup
authorSteffen Klassert <steffen.klassert@secunet.com>
Tue, 15 Mar 2011 21:12:49 +0000 (21:12 +0000)
committerDavid S. Miller <davem@davemloft.net>
Wed, 16 Mar 2011 19:55:36 +0000 (12:55 -0700)
We return a destination entry without refcount if a socket
policy is found in xfrm_lookup. This triggers a warning on
a negative refcount when freeeing this dst entry. So take
a refcount in this case to fix it.

This refcount was forgotten when xfrm changed to cache bundles
instead of policies for outgoing flows.

Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Acked-by: Timo Teräs <timo.teras@iki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/xfrm/xfrm_policy.c

index 027e3c6fb7e4442189773eda8ddbaf9fd283485a..15792d8b62721f2ce3b33ccb24556942063a966b 100644 (file)
@@ -1804,6 +1804,8 @@ restart:
                                goto no_transform;
                        }
 
+                       dst_hold(&xdst->u.dst);
+
                        spin_lock_bh(&xfrm_policy_sk_bundle_lock);
                        xdst->u.dst.next = xfrm_policy_sk_bundles;
                        xfrm_policy_sk_bundles = &xdst->u.dst;