dst: Clone child entry in skb_dst_pop
We clone the child entry in skb_dst_pop before we call skb_dst_drop(). Otherwise we might kill the child right before we return it to the caller. Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
3bc07321cc
commit
e433430a0c
|
@ -345,7 +345,7 @@ static inline void skb_tunnel_rx(struct sk_buff *skb, struct net_device *dev)
|
||||||
|
|
||||||
static inline struct dst_entry *skb_dst_pop(struct sk_buff *skb)
|
static inline struct dst_entry *skb_dst_pop(struct sk_buff *skb)
|
||||||
{
|
{
|
||||||
struct dst_entry *child = skb_dst(skb)->child;
|
struct dst_entry *child = dst_clone(skb_dst(skb)->child);
|
||||||
|
|
||||||
skb_dst_drop(skb);
|
skb_dst_drop(skb);
|
||||||
return child;
|
return child;
|
||||||
|
|
|
@ -96,7 +96,7 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
|
||||||
err = -EHOSTUNREACH;
|
err = -EHOSTUNREACH;
|
||||||
goto error_nolock;
|
goto error_nolock;
|
||||||
}
|
}
|
||||||
skb_dst_set(skb, dst_clone(dst));
|
skb_dst_set(skb, dst);
|
||||||
x = dst->xfrm;
|
x = dst->xfrm;
|
||||||
} while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL));
|
} while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL));
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue