diff options
| author | Alexey Dobriyan <adobriyan@gmail.com> | 2008-11-25 17:57:44 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-11-25 17:57:44 -0800 |
| commit | 7c2776ee21a60e0d370538bd08b9ed82979f6e3a (patch) | |
| tree | c8b9757f6989216c00b5ca9e09ee074662fff586 | |
| parent | fbda33b2b85941c1ae3a0d89522dec5c1b1bd98c (diff) | |
| download | op-kernel-dev-7c2776ee21a60e0d370538bd08b9ed82979f6e3a.zip op-kernel-dev-7c2776ee21a60e0d370538bd08b9ed82979f6e3a.tar.gz | |
netns xfrm: flush SA/SPDs on netns stop
SA/SPD doesn't pin netns (and it shouldn't), so get rid of them by hand.
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/xfrm/xfrm_policy.c | 14 | ||||
| -rw-r--r-- | net/xfrm/xfrm_state.c | 8 |
2 files changed, 22 insertions, 0 deletions
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 7c7bb54..fcf8c92 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -2441,9 +2441,23 @@ out_byidx: static void xfrm_policy_fini(struct net *net) { + struct xfrm_audit audit_info; unsigned int sz; int dir; + flush_work(&net->xfrm.policy_hash_work); +#ifdef CONFIG_XFRM_SUB_POLICY + audit_info.loginuid = -1; + audit_info.sessionid = -1; + audit_info.secid = 0; + xfrm_policy_flush(net, XFRM_POLICY_TYPE_SUB, &audit_info); +#endif + audit_info.loginuid = -1; + audit_info.sessionid = -1; + audit_info.secid = 0; + xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, &audit_info); + flush_work(&xfrm_policy_gc_work); + WARN_ON(!list_empty(&net->xfrm.policy_all)); for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) { diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index d594b5a..662e47b 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -2114,8 +2114,16 @@ out_bydst: void xfrm_state_fini(struct net *net) { + struct xfrm_audit audit_info; unsigned int sz; + flush_work(&net->xfrm.state_hash_work); + audit_info.loginuid = -1; + audit_info.sessionid = -1; + audit_info.secid = 0; + xfrm_state_flush(net, IPSEC_PROTO_ANY, &audit_info); + flush_work(&net->xfrm.state_gc_work); + WARN_ON(!list_empty(&net->xfrm.state_all)); sz = (net->xfrm.state_hmask + 1) * sizeof(struct hlist_head); |
