[PATCH] Fix oops in xfrm4_dst_destroy()

[PATCH] Fix oops in xfrm4_dst_destroy()

[Bernhard Walle]

With 2.6.21-rc1, I get an oops when running 'ifdown eth0' and an IPsec
connection is active. If I shut down the connection before running 'ifdown
eth0', then there's no problem.  The critical operation of this script is to
kill dhcpd.

The problem is probably caused by commit with git identifier
4337226228e1cfc1d70ee975789c6bd070fb597c (Linus tree) "[IPSEC]: IPv4 over IPv6
IPsec tunnel".

This patch fixes that oops. I don't know the network code of the Linux kernel
in deep, so if that fix is wrong, please change it. But please fix the oops. :)


Signed-off-by: Bernhard Walle <bwalle@suse.de>
---
 net/ipv4/xfrm4_policy.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Index: linux-2.6.21-rc1/net/ipv4/xfrm4_policy.c
===================================================================
--- linux-2.6.21-rc1.orig/net/ipv4/xfrm4_policy.c
+++ linux-2.6.21-rc1/net/ipv4/xfrm4_policy.c
@@ -291,7 +291,7 @@ static void xfrm4_dst_destroy(struct dst
 
 	if (likely(xdst->u.rt.idev))
 		in_dev_put(xdst->u.rt.idev);
-	if (dst->xfrm->props.family == AF_INET && likely(xdst->u.rt.peer))
+	if (dst->xfrm && dst->xfrm->props.family == AF_INET && likely(xdst->u.rt.peer))
 		inet_putpeer(xdst->u.rt.peer);
 	xfrm_dst_destroy(xdst);
 }

Re: [PATCH] Fix oops in xfrm4_dst_destroy()

[Patrick McHardy]

Bernhard Walle wrote:
> With 2.6.21-rc1, I get an oops when running 'ifdown eth0' and an IPsec
> connection is active. If I shut down the connection before running 'ifdown
> eth0', then there's no problem.  The critical operation of this script is to
> kill dhcpd.
> 
> The problem is probably caused by commit with git identifier
> 4337226228e1cfc1d70ee975789c6bd070fb597c (Linus tree) "[IPSEC]: IPv4 over IPv6
> IPsec tunnel".
> 
> This patch fixes that oops. I don't know the network code of the Linux kernel
> in deep, so if that fix is wrong, please change it. But please fix the oops. :)

Looks good, when the xfrm_dst is freed in __xfrm4_bundle_create
after a failed call to xfrm_dst_lookup the xfrm pointer is not
set, and this is also expected by xfrm_dst_destroy.

Acked-by: Patrick McHardy <kaber@trash.net>

> ---
>  net/ipv4/xfrm4_policy.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> Index: linux-2.6.21-rc1/net/ipv4/xfrm4_policy.c
> ===================================================================
> --- linux-2.6.21-rc1.orig/net/ipv4/xfrm4_policy.c
> +++ linux-2.6.21-rc1/net/ipv4/xfrm4_policy.c
> @@ -291,7 +291,7 @@ static void xfrm4_dst_destroy(struct dst
>  
>  	if (likely(xdst->u.rt.idev))
>  		in_dev_put(xdst->u.rt.idev);
> -	if (dst->xfrm->props.family == AF_INET && likely(xdst->u.rt.peer))
> +	if (dst->xfrm && dst->xfrm->props.family == AF_INET && likely(xdst->u.rt.peer))
>  		inet_putpeer(xdst->u.rt.peer);
>  	xfrm_dst_destroy(xdst);
>  }

Re: [PATCH] Fix oops in xfrm4_dst_destroy()

[David Miller]

From: Patrick McHardy <kaber@trash.net>
Date: Mon, 26 Feb 2007 01:24:37 +0100

> Bernhard Walle wrote:
> > With 2.6.21-rc1, I get an oops when running 'ifdown eth0' and an IPsec
> > connection is active. If I shut down the connection before running 'ifdown
> > eth0', then there's no problem.  The critical operation of this script is to
> > kill dhcpd.
> > 
> > The problem is probably caused by commit with git identifier
> > 4337226228e1cfc1d70ee975789c6bd070fb597c (Linus tree) "[IPSEC]: IPv4 over IPv6
> > IPsec tunnel".
> > 
> > This patch fixes that oops. I don't know the network code of the Linux kernel
> > in deep, so if that fix is wrong, please change it. But please fix the oops. :)
> 
> Looks good, when the xfrm_dst is freed in __xfrm4_bundle_create
> after a failed call to xfrm_dst_lookup the xfrm pointer is not
> set, and this is also expected by xfrm_dst_destroy.
> 
> Acked-by: Patrick McHardy <kaber@trash.net>

Patch applied, thanks everyone.