Commit c5d4d7d8 authored Sep 04, 2017 by Steffen Klassert

xfrm: Fix deletion of offloaded SAs on failure.



When we off load a SA, it gets pushed to the NIC before we can
add it. In case of a failure, we don't delete this SA from the
NIC. Fix this by calling xfrm_dev_state_delete on failure.

Fixes: d77e38e6 ("xfrm: Add an IPsec hardware offloading API")
Reported-by: Shannon Nelson <shannon.nelson@oracle.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

parent 1f4f554a

net/xfrm/xfrm_user.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -657,6 +657,7 @@ static int xfrm_add_sa(struct sk_buff skb, struct nlmsghdr nlh,

		if (err < 0) {
		x->km.state = XFRM_STATE_DEAD;
		xfrm_dev_state_delete(x);
		__xfrm_state_put(x);
		goto out;
		}