xfrm: Fix negative device refcount on offload failure.

klassert · klassert · commit 67a63387b141 · 2017-09-11T10:36:51.000+02:00
Reset the offload device at the xfrm_state if the device was not able to offload the state. Otherwise we drop the device refcount twice. Fixes: d77e38e ("xfrm: Add an IPsec hardware offloading API") Reported-by: Shannon Nelson <shannon.nelson@oracle.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
@@ -91,6 +91,7 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
 	}
 
 	if (!dev->xfrmdev_ops || !dev->xfrmdev_ops->xdo_dev_state_add) {
+		xso->dev = NULL;
 		dev_put(dev);
 		return 0;
 	}

Original file line number	Diff line number	Diff line change
`@@ -91,6 +91,7 @@ int xfrm_dev_state_add(struct net net, struct xfrm_state x,`
`91`	`91`	`}`
`92`	`92`
`93`	`93`	`if (!dev->xfrmdev_ops \|\| !dev->xfrmdev_ops->xdo_dev_state_add) {`
	`94`	`+ xso->dev = NULL;`
`94`	`95`	`dev_put(dev);`
`95`	`96`	`return 0;`
`96`	`97`	`}`