[IPSEC]: Fix zero return value in xfrm_lookup on error

[IPSEC]: Fix zero return value in xfrm_lookup on error

[Herbert Xu]

Hi Dave:

Found another silly bug in my ICMP relookup patch.

[IPSEC]: Fix zero return value in xfrm_lookup on error

Further testing shows that my ICMP relookup patch can cause xfrm_lookup
to return zero on error which isn't very nice since it leads to the caller
dying on null pointer dereference.  The bug is due to not setting err
to ENOENT just before we leave xfrm_lookup in case of no policy.

This patch moves the err setting to where it should be.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index b04d88c..d2084b1 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1469,8 +1469,6 @@ restart:
 			goto dropdst;
 	}
 
-	err = -ENOENT;
-
 	if (!policy) {
 		/* To accelerate a bit...  */
 		if ((dst_orig->flags & DST_NOXFRM) ||
@@ -1492,6 +1490,7 @@ restart:
 	npols ++;
 	xfrm_nr += pols[0]->xfrm_nr;
 
+	err = -ENOENT;
 	if ((flags & XFRM_LOOKUP_ICMP) && !(policy->flags & XFRM_POLICY_ICMP))
 		goto error;
 
@@ -1657,6 +1656,7 @@ dropdst:
 	return err;
 
 nopol:
+	err = -ENOENT;
 	if (flags & XFRM_LOOKUP_ICMP)
 		goto dropdst;
 	return 0;

Thanks,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [IPSEC]: Fix zero return value in xfrm_lookup on error

[David Miller]

From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Fri, 14 Dec 2007 00:44:48 +0800

> [IPSEC]: Fix zero return value in xfrm_lookup on error
> 
> Further testing shows that my ICMP relookup patch can cause xfrm_lookup
> to return zero on error which isn't very nice since it leads to the caller
> dying on null pointer dereference.  The bug is due to not setting err
> to ENOENT just before we leave xfrm_lookup in case of no policy.
> 
> This patch moves the err setting to where it should be.
> 
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Applied, thanks.