From: Xin Long <lucien....@gmail.com>

This xfrm_state_put call in esp4/6_gro_receive() will cause
double put for state, as in out_reset path secpath_reset()
will put all states set in skb sec_path.

So fix it by simply remove the xfrm_state_put call.

Fixes: 6ed69184ed9c ("xfrm: Reset secpath in xfrm failure")
Signed-off-by: Xin Long <lucien....@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klass...@secunet.com>
---
 net/ipv4/esp4_offload.c | 4 +---
 net/ipv6/esp6_offload.c | 4 +---
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c
index 731022cff600..231edcb84c08 100644
--- a/net/ipv4/esp4_offload.c
+++ b/net/ipv4/esp4_offload.c
@@ -63,10 +63,8 @@ static struct sk_buff *esp4_gro_receive(struct list_head 
*head,
                sp->olen++;
 
                xo = xfrm_offload(skb);
-               if (!xo) {
-                       xfrm_state_put(x);
+               if (!xo)
                        goto out_reset;
-               }
        }
 
        xo->flags |= XFRM_GRO;
diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c
index b82850886574..b92372b104ba 100644
--- a/net/ipv6/esp6_offload.c
+++ b/net/ipv6/esp6_offload.c
@@ -85,10 +85,8 @@ static struct sk_buff *esp6_gro_receive(struct list_head 
*head,
                sp->olen++;
 
                xo = xfrm_offload(skb);
-               if (!xo) {
-                       xfrm_state_put(x);
+               if (!xo)
                        goto out_reset;
-               }
        }
 
        xo->flags |= XFRM_GRO;
-- 
2.17.1

Reply via email to