diff options
| author |   Herbert Xu <herbert@gondor.apana.org.au> | 2006-03-26 17:37:54 -0800 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2006-03-26 17:37:54 -0800 |
| commit | 6abaaaae6d5ed52422c8caf65f3cdbb95579bb58 (patch) | |
| tree | d35a7ca08d9ced7c7204197d2dd532bd3c8971fe /include/net | |
| parent | [PATCH] one ipc/sem.c->mutex.c converstion too many.. (diff) | |
| download | linux-dev-6abaaaae6d5ed52422c8caf65f3cdbb95579bb58.tar.xz linux-dev-6abaaaae6d5ed52422c8caf65f3cdbb95579bb58.zip | |
[IPSEC]: Fix tunnel error handling in ipcomp6
The error handling in ipcomp6_tunnel_create is broken in two ways:
1) If we fail to allocate an SPI (this should never happen in practice
since there are plenty of 32-bit SPI values for us to use), we will
still go ahead and create the SA.
2) When xfrm_init_state fails, we first of all may trigger the BUG_TRAP
in __xfrm_state_destroy because we didn't set the state to DEAD. More
importantly we end up returning the freed state as if we succeeded!
This patch fixes them both.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/net')
0 files changed, 0 insertions, 0 deletions