From a1aa3483041bd3691c7f029272ccef4ce70bd957 Mon Sep 17 00:00:00 2001 From: Timo Teras Date: Sat, 15 May 2010 23:49:26 -0700 Subject: xfrm: fix policy unreferencing on larval drop I mistakenly had the error path to use num_pols to decide how many policies we need to drop (cruft from earlier patch set version which did not handle socket policies right). This is wrong since normally we do not keep explicit references (instead we hold reference to the cache entry which holds references to policies). drop_pols is set to num_pols if we are holding the references, so use that. Otherwise we eventually BUG_ON inside xfrm_policy_destroy due to premature policy deletion. Signed-off-by: Timo Teras Signed-off-by: David S. Miller --- net/xfrm/xfrm_policy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'net') diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 31f4ba43b48f..f4ea3a08e5a1 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -1805,7 +1805,7 @@ restart: /* EREMOTE tells the caller to generate * a one-shot blackhole route. */ dst_release(dst); - xfrm_pols_put(pols, num_pols); + xfrm_pols_put(pols, drop_pols); XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES); return -EREMOTE; } -- cgit v1.2.3