Re: [PATCH 1/1] double xfrm_state_put bug fix

[Herbert Xu]

On Tue, Jan 17, 2006 at 06:29:26PM -0800, David S. Miller wrote:
> 
> There is a big comment in __xfrm_state_delete(), would you like
> something more? :-)

How about something like this? This should make someone think twice
before treating it as a duplicate.

[IPSEC]: Turn first xfrm_state_put into atomic_dec

We need to do two xfrm_state_put's in a row in order to kill a state
that's not linked into the system.  Since we know that the first put
is not going to free the structure, we can turn it into an atomic_dec.

This should also tell people that the two put's are intentional and
not a bug.

Signed-off-by: Herbert Xu <[EMAIL PROTECTED]>

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[EMAIL PROTECTED]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

diff --git a/net/key/af_key.c b/net/key/af_key.c
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1423,7 +1423,7 @@ static int pfkey_add(struct sock *sk, st
 
        if (err < 0) {
                x->km.state = XFRM_STATE_DEAD;
-               xfrm_state_put(x);
+               atomic_dec(&x->refcnt);
                goto out;
        }
 
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -345,7 +345,7 @@ static int xfrm_add_sa(struct sk_buff *s
 
        if (err < 0) {
                x->km.state = XFRM_STATE_DEAD;
-               xfrm_state_put(x);
+               atomic_dec(&x->refcnt);
                goto out;
        }