From: Kazunori Miyazawa <kazunori@miyazawa.org>

[XFRM] Call dst_check() with appropriate cookie

This fixes infinite loop issue with IPv6 tunnel mode.

Signed-off-by: Kazunori Miyazawa <kazunori@miyazawa.org>
Signed-off-by: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

3 files changed, 8 insertions, 2 deletions

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index e142a256d5dc..d675836ba6c3 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -515,6 +515,8 @@ struct xfrm_dst
         struct dst_entry *route;
         u32 route_mtu_cached;
         u32 child_mtu_cached;
+        u32 route_cookie;
+        u32 path_cookie;
 };
 
 static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 4429b1a1fe5f..cf1d91e74c82 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -113,6 +113,8 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
 
                 xdst = (struct xfrm_dst *)dst1;
                 xdst->route = &rt->u.dst;
+                if (rt->rt6i_node)
+                        xdst->route_cookie = rt->rt6i_node->fn_sernum;
 
                 dst1->next = dst_prev;
                 dst_prev = dst1;
@@ -137,6 +139,8 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
 
         dst_prev->child = &rt->u.dst;
         dst->path = &rt->u.dst;
+        if (rt->rt6i_node)
+                ((struct xfrm_dst *)dst)->path_cookie = rt->rt6i_node->fn_sernum;
 
         *dst_p = dst;
         dst = dst_prev;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 55ed979db144..d07f5ce31824 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1136,7 +1136,7 @@ int xfrm_bundle_ok(struct xfrm_dst *first, struct flowi *fl, int family)
         struct xfrm_dst *last;
         u32 mtu;
 
-        if (!dst_check(dst->path, 0) ||
+        if (!dst_check(dst->path, ((struct xfrm_dst *)dst)->path_cookie) ||
             (dst->dev && !netif_running(dst->dev)))
                 return 0;
 
@@ -1156,7 +1156,7 @@ int xfrm_bundle_ok(struct xfrm_dst *first, struct flowi *fl, int family)
                         xdst->child_mtu_cached = mtu;
                 }
 
-                if (!dst_check(xdst->route, 0))
+                if (!dst_check(xdst->route, xdst->route_cookie))
                         return 0;
                 mtu = dst_mtu(xdst->route);
                 if (xdst->route_mtu_cached != mtu) {