3 files changed, 87 insertions, 23 deletions

diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 7fe2afd2e669..b2b60f3e9cdd 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -8,7 +8,10 @@
  *      
  */
 
+#include <asm/bug.h>
+#include <linux/compiler.h>
 #include <linux/config.h>
+#include <linux/inetdevice.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
 
@@ -152,6 +155,8 @@ __xfrm4_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
                 x->u.rt.rt_dst = rt0->rt_dst;
                 x->u.rt.rt_gateway = rt->rt_gateway;
                 x->u.rt.rt_spec_dst = rt0->rt_spec_dst;
+                x->u.rt.idev = rt0->idev;
+                in_dev_hold(rt0->idev);
                 header_len -= x->u.dst.xfrm->props.header_len;
                 trailer_len -= x->u.dst.xfrm->props.trailer_len;
         }
@@ -243,11 +248,48 @@ static void xfrm4_update_pmtu(struct dst_entry *dst, u32 mtu)
         path->ops->update_pmtu(path, mtu);
 }
 
+static void xfrm4_dst_destroy(struct dst_entry *dst)
+{
+        struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
+
+        if (likely(xdst->u.rt.idev))
+                in_dev_put(xdst->u.rt.idev);
+        xfrm_dst_destroy(xdst);
+}
+
+static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
+                             int unregister)
+{
+        struct xfrm_dst *xdst;
+
+        if (!unregister)
+                return;
+
+        xdst = (struct xfrm_dst *)dst;
+        if (xdst->u.rt.idev->dev == dev) {
+                struct in_device *loopback_idev = in_dev_get(&loopback_dev);
+                BUG_ON(!loopback_idev);
+
+                do {
+                        in_dev_put(xdst->u.rt.idev);
+                        xdst->u.rt.idev = loopback_idev;
+                        in_dev_hold(loopback_idev);
+                        xdst = (struct xfrm_dst *)xdst->u.dst.child;
+                } while (xdst->u.dst.xfrm);
+
+                __in_dev_put(loopback_idev);
+        }
+
+        xfrm_dst_ifdown(dst, dev);
+}
+
 static struct dst_ops xfrm4_dst_ops = {
         .family =               AF_INET,
         .protocol =             __constant_htons(ETH_P_IP),
         .gc =                   xfrm4_garbage_collect,
         .update_pmtu =          xfrm4_update_pmtu,
+        .destroy =              xfrm4_dst_destroy,
+        .ifdown =               xfrm4_dst_ifdown,
         .gc_thresh =            1024,
         .entry_size =           sizeof(struct xfrm_dst),
 };
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 8a4f37de4d2d..4429b1a1fe5f 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -11,7 +11,11 @@
  * 
  */
 
+#include <asm/bug.h>
+#include <linux/compiler.h>
 #include <linux/config.h>
+#include <linux/netdevice.h>
+#include <net/addrconf.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
@@ -166,6 +170,8 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
                 memcpy(&x->u.rt6.rt6i_gateway, &rt0->rt6i_gateway, sizeof(x->u.rt6.rt6i_gateway)); 
                 x->u.rt6.rt6i_dst      = rt0->rt6i_dst;
                 x->u.rt6.rt6i_src      = rt0->rt6i_src; 
+                x->u.rt6.rt6i_idev     = rt0->rt6i_idev;
+                in6_dev_hold(rt0->rt6i_idev);
                 header_len -= x->u.dst.xfrm->props.header_len;
                 trailer_len -= x->u.dst.xfrm->props.trailer_len;
         }
@@ -251,11 +257,48 @@ static void xfrm6_update_pmtu(struct dst_entry *dst, u32 mtu)
         path->ops->update_pmtu(path, mtu);
 }
 
+static void xfrm6_dst_destroy(struct dst_entry *dst)
+{
+        struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
+
+        if (likely(xdst->u.rt6.rt6i_idev))
+                in6_dev_put(xdst->u.rt6.rt6i_idev);
+        xfrm_dst_destroy(xdst);
+}
+
+static void xfrm6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
+                             int unregister)
+{
+        struct xfrm_dst *xdst;
+
+        if (!unregister)
+                return;
+
+        xdst = (struct xfrm_dst *)dst;
+        if (xdst->u.rt6.rt6i_idev->dev == dev) {
+                struct inet6_dev *loopback_idev = in6_dev_get(&loopback_dev);
+                BUG_ON(!loopback_idev);
+
+                do {
+                        in6_dev_put(xdst->u.rt6.rt6i_idev);
+                        xdst->u.rt6.rt6i_idev = loopback_idev;
+                        in6_dev_hold(loopback_idev);
+                        xdst = (struct xfrm_dst *)xdst->u.dst.child;
+                } while (xdst->u.dst.xfrm);
+
+                __in6_dev_put(loopback_idev);
+        }
+
+        xfrm_dst_ifdown(dst, dev);
+}
+
 static struct dst_ops xfrm6_dst_ops = {
         .family =               AF_INET6,
         .protocol =             __constant_htons(ETH_P_IPV6),
         .gc =                   xfrm6_garbage_collect,
         .update_pmtu =          xfrm6_update_pmtu,
+        .destroy =              xfrm6_dst_destroy,
+        .ifdown =               xfrm6_dst_ifdown,
         .gc_thresh =            1024,
         .entry_size =           sizeof(struct xfrm_dst),
 };
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 80828078733d..55ed979db144 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1028,30 +1028,15 @@ static int stale_bundle(struct dst_entry *dst)
         return !xfrm_bundle_ok((struct xfrm_dst *)dst, NULL, AF_UNSPEC);
 }
 
-static void xfrm_dst_destroy(struct dst_entry *dst)
+void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev)
 {
-        struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
-
-        dst_release(xdst->route);
-
-        if (!dst->xfrm)
-                return;
-        xfrm_state_put(dst->xfrm);
-        dst->xfrm = NULL;
-}
-
-static void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
-                            int unregister)
-{
-        if (!unregister)
-                return;
-
         while ((dst = dst->child) && dst->xfrm && dst->dev == dev) {
                 dst->dev = &loopback_dev;
                 dev_hold(&loopback_dev);
                 dev_put(dev);
         }
 }
+EXPORT_SYMBOL(xfrm_dst_ifdown);
 
 static void xfrm_link_failure(struct sk_buff *skb)
 {
@@ -1262,10 +1247,6 @@ int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
                         dst_ops->kmem_cachep = xfrm_dst_cache;
                 if (likely(dst_ops->check == NULL))
                         dst_ops->check = xfrm_dst_check;
-                if (likely(dst_ops->destroy == NULL))
-                        dst_ops->destroy = xfrm_dst_destroy;
-                if (likely(dst_ops->ifdown == NULL))
-                        dst_ops->ifdown = xfrm_dst_ifdown;
                 if (likely(dst_ops->negative_advice == NULL))
                         dst_ops->negative_advice = xfrm_negative_advice;
                 if (likely(dst_ops->link_failure == NULL))
@@ -1297,8 +1278,6 @@ int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo)
                         xfrm_policy_afinfo[afinfo->family] = NULL;
                         dst_ops->kmem_cachep = NULL;
                         dst_ops->check = NULL;
-                        dst_ops->destroy = NULL;
-                        dst_ops->ifdown = NULL;
                         dst_ops->negative_advice = NULL;
                         dst_ops->link_failure = NULL;
                         dst_ops->get_mss = NULL;