From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Tue, 1 Jun 2010 10:04:49 +0000 (+0000)
Subject: xfrm: force a dst reference in __xfrm_route_forward()
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=fafeeb6c80e3842c6dc19d05de09a23f23eef0d8;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git

xfrm: force a dst reference in __xfrm_route_forward()

Packets going through __xfrm_route_forward() have a not refcounted dst
entry, since we enabled a noref forwarding path.

xfrm_lookup() might incorrectly release this dst entry.

It's a bit late to make invasive changes in xfrm_lookup(), so lets force
a refcount in this path.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index d965a2bad8d3..4bf27d901333 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2153,6 +2153,7 @@ int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
 		return 0;
 	}
 
+	skb_dst_force(skb);
 	dst = skb_dst(skb);
 
 	res = xfrm_lookup(net, &dst, &fl, NULL, 0) == 0;