1 files changed, 20 insertions, 9 deletions

diff --git a/net/key/af_key.c b/net/key/af_key.c
index 545f047868ad..1a04c1329362 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1340,6 +1340,12 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, const struct sadb_
                 max_spi = range->sadb_spirange_max;
         }
 
+        err = verify_spi_info(x->id.proto, min_spi, max_spi);
+        if (err) {
+                xfrm_state_put(x);
+                return err;
+        }
+
         err = xfrm_alloc_spi(x, min_spi, max_spi);
         resp_skb = err ? ERR_PTR(err) : pfkey_xfrm_state2msg(x);
 
@@ -1380,10 +1386,9 @@ static int pfkey_acquire(struct sock *sk, struct sk_buff *skb, const struct sadb
                 return 0;
 
         spin_lock_bh(&x->lock);
-        if (x->km.state == XFRM_STATE_ACQ) {
+        if (x->km.state == XFRM_STATE_ACQ)
                 x->km.state = XFRM_STATE_ERROR;
-                wake_up(&net->xfrm.km_waitq);
-        }
+
         spin_unlock_bh(&x->lock);
         xfrm_state_put(x);
         return 0;
@@ -1785,7 +1790,9 @@ static int pfkey_dump_sa(struct pfkey_sock *pfk)
 
 static void pfkey_dump_sa_done(struct pfkey_sock *pfk)
 {
-        xfrm_state_walk_done(&pfk->dump.u.state);
+        struct net *net = sock_net(&pfk->sk);
+
+        xfrm_state_walk_done(&pfk->dump.u.state, net);
 }
 
 static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr, void * const *ext_hdrs)
@@ -1861,7 +1868,7 @@ static u32 gen_reqid(struct net *net)
                         reqid = IPSEC_MANUAL_REQID_MAX+1;
                 xfrm_policy_walk_init(&walk, XFRM_POLICY_TYPE_MAIN);
                 rc = xfrm_policy_walk(net, &walk, check_reqid, (void*)&reqid);
-                xfrm_policy_walk_done(&walk);
+                xfrm_policy_walk_done(&walk, net);
                 if (rc != -EEXIST)
                         return reqid;
         } while (reqid != start);
@@ -2485,6 +2492,7 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
         struct xfrm_selector sel;
         struct xfrm_migrate m[XFRM_MAX_DEPTH];
         struct xfrm_kmaddress k;
+        struct net *net = sock_net(sk);
 
         if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
                                      ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
@@ -2558,7 +2566,7 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
         }
 
         return xfrm_migrate(&sel, dir, XFRM_POLICY_TYPE_MAIN, m, i,
-                            kma ? &k : NULL);
+                            kma ? &k : NULL, net);
 
  out:
         return err;
@@ -2659,7 +2667,9 @@ static int pfkey_dump_sp(struct pfkey_sock *pfk)
 
 static void pfkey_dump_sp_done(struct pfkey_sock *pfk)
 {
-        xfrm_policy_walk_done(&pfk->dump.u.policy);
+        struct net *net = sock_net((struct sock *)pfk);
+
+        xfrm_policy_walk_done(&pfk->dump.u.policy, net);
 }
 
 static int pfkey_spddump(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr, void * const *ext_hdrs)
@@ -3569,6 +3579,7 @@ static int pfkey_sendmsg(struct kiocb *kiocb,
         struct sk_buff *skb = NULL;
         struct sadb_msg *hdr = NULL;
         int err;
+        struct net *net = sock_net(sk);
 
         err = -EOPNOTSUPP;
         if (msg->msg_flags & MSG_OOB)
@@ -3591,9 +3602,9 @@ static int pfkey_sendmsg(struct kiocb *kiocb,
         if (!hdr)
                 goto out;
 
-        mutex_lock(&xfrm_cfg_mutex);
+        mutex_lock(&net->xfrm.xfrm_cfg_mutex);
         err = pfkey_process(sk, skb, hdr);
-        mutex_unlock(&xfrm_cfg_mutex);
+        mutex_unlock(&net->xfrm.xfrm_cfg_mutex);
 
 out:
         if (err && hdr && pfkey_error(hdr, err, sk) == 0)