Re: [PATCH] Fix oops in xfrm4_dst_destroy()

[Patrick McHardy <kaber@trash.net>]

Bernhard Walle wrote:
> With 2.6.21-rc1, I get an oops when running 'ifdown eth0' and an IPsec
> connection is active. If I shut down the connection before running 'ifdown
> eth0', then there's no problem.  The critical operation of this script is to
> kill dhcpd.
> 
> The problem is probably caused by commit with git identifier
> 4337226228e1cfc1d70ee975789c6bd070fb597c (Linus tree) "[IPSEC]: IPv4 over IPv6
> IPsec tunnel".
> 
> This patch fixes that oops. I don't know the network code of the Linux kernel
> in deep, so if that fix is wrong, please change it. But please fix the oops. :)

Looks good, when the xfrm_dst is freed in __xfrm4_bundle_create
after a failed call to xfrm_dst_lookup the xfrm pointer is not
set, and this is also expected by xfrm_dst_destroy.

Acked-by: Patrick McHardy <kaber@trash.net>

> ---
>  net/ipv4/xfrm4_policy.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> Index: linux-2.6.21-rc1/net/ipv4/xfrm4_policy.c
> ===================================================================
> --- linux-2.6.21-rc1.orig/net/ipv4/xfrm4_policy.c
> +++ linux-2.6.21-rc1/net/ipv4/xfrm4_policy.c
> @@ -291,7 +291,7 @@ static void xfrm4_dst_destroy(struct dst
>  
>  	if (likely(xdst->u.rt.idev))
>  		in_dev_put(xdst->u.rt.idev);
> -	if (dst->xfrm->props.family == AF_INET && likely(xdst->u.rt.peer))
> +	if (dst->xfrm && dst->xfrm->props.family == AF_INET && likely(xdst->u.rt.peer))
>  		inet_putpeer(xdst->u.rt.peer);
>  	xfrm_dst_destroy(xdst);
>  }