diff options
| author | Herbert Xu <herbert@gondor.apana.org.au> | 2007-12-30 21:09:38 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-01-28 15:00:09 -0800 |
| commit | fcb8c156c8277ee9d71c8c81587d494c9c5240b3 (patch) | |
| tree | 49ee171a80205f7c8d9cd9ae4e02955b547d11e6 /net | |
| parent | 15ca36fb994923b454df44e5d7aa14b84ce5aee4 (diff) | |
| download | op-kernel-dev-fcb8c156c8277ee9d71c8c81587d494c9c5240b3.zip op-kernel-dev-fcb8c156c8277ee9d71c8c81587d494c9c5240b3.tar.gz | |
[IPSEC]: Fix double free on skb on async output
When the output transform returns EINPROGRESS due to async operation we'll
free the skb the straight away as if it were an error. This patch fixes
that so that the skb is freed when the async operation completes.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/xfrm/xfrm_output.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c index c1ba63e..81ad8eb 100644 --- a/net/xfrm/xfrm_output.c +++ b/net/xfrm/xfrm_output.c @@ -78,6 +78,8 @@ static int xfrm_output_one(struct sk_buff *skb, int err) spin_unlock_bh(&x->lock); err = x->type->output(x, skb); + if (err == -EINPROGRESS) + goto out_exit; resume: if (err) { |
