aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorHerbert Xu <herbert@gondor.apana.org.au>2008-05-20 17:32:14 -0400
committerDavid S. Miller <davem@davemloft.net>2008-05-20 17:32:14 -0400
commit1ac06e0306d0192a7a4d9ea1c9e06d355ce7e7d3 (patch)
tree610968ecaa89b3b9144db508dc2bd650afadce74 /net
parent6f704992d3658aadff9e506c7fd80957fce33c5f (diff)
ipsec: Use the correct ip_local_out function
Because the IPsec output function xfrm_output_resume does its own dst_output call it should always call __ip_local_output instead of ip_local_output as the latter may invoke dst_output directly. Otherwise the return values from nf_hook and dst_output may clash as they both use the value 1 but for different purposes. When that clash occurs this can cause a packet to be used after it has been freed which usually leads to a crash. Because the offending value is only returned from dst_output with qdiscs such as HTB, this bug is normally not visible. Thanks to Marco Berizzi for his perseverance in tracking this down. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/ipv4/route.c2
-rw-r--r--net/ipv6/route.c2
2 files changed, 2 insertions, 2 deletions
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 92f90ae46f4a..df41026b60db 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -160,7 +160,7 @@ static struct dst_ops ipv4_dst_ops = {
160 .negative_advice = ipv4_negative_advice, 160 .negative_advice = ipv4_negative_advice,
161 .link_failure = ipv4_link_failure, 161 .link_failure = ipv4_link_failure,
162 .update_pmtu = ip_rt_update_pmtu, 162 .update_pmtu = ip_rt_update_pmtu,
163 .local_out = ip_local_out, 163 .local_out = __ip_local_out,
164 .entry_size = sizeof(struct rtable), 164 .entry_size = sizeof(struct rtable),
165 .entries = ATOMIC_INIT(0), 165 .entries = ATOMIC_INIT(0),
166}; 166};
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index b7a4a875a26a..48534c6c0735 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -109,7 +109,7 @@ static struct dst_ops ip6_dst_ops_template = {
109 .negative_advice = ip6_negative_advice, 109 .negative_advice = ip6_negative_advice,
110 .link_failure = ip6_link_failure, 110 .link_failure = ip6_link_failure,
111 .update_pmtu = ip6_rt_update_pmtu, 111 .update_pmtu = ip6_rt_update_pmtu,
112 .local_out = ip6_local_out, 112 .local_out = __ip6_local_out,
113 .entry_size = sizeof(struct rt6_info), 113 .entry_size = sizeof(struct rt6_info),
114 .entries = ATOMIC_INIT(0), 114 .entries = ATOMIC_INIT(0),
115}; 115};