Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7c2776ee authored by Alexey Dobriyan's avatar Alexey Dobriyan Committed by David S. Miller
Browse files

netns xfrm: flush SA/SPDs on netns stop 



SA/SPD doesn't pin netns (and it shouldn't), so get rid of them by hand.

Signed-off-by: default avatarAlexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent fbda33b2

net/xfrm/xfrm_policy.c

+14 −0
Original line number Diff line number Diff line
@@ -2441,9 +2441,23 @@ out_byidx: 


static void xfrm_policy_fini(struct net *net)

{

	struct xfrm_audit audit_info;

	unsigned int sz;

	int dir;



	flush_work(&net->xfrm.policy_hash_work);

#ifdef CONFIG_XFRM_SUB_POLICY

	audit_info.loginuid = -1;

	audit_info.sessionid = -1;

	audit_info.secid = 0;

	xfrm_policy_flush(net, XFRM_POLICY_TYPE_SUB, &audit_info);

#endif

	audit_info.loginuid = -1;

	audit_info.sessionid = -1;

	audit_info.secid = 0;

	xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, &audit_info);

	flush_work(&xfrm_policy_gc_work);



	WARN_ON(!list_empty(&net->xfrm.policy_all));



	for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) {

net/xfrm/xfrm_state.c

+8 −0
Original line number Diff line number Diff line
@@ -2114,8 +2114,16 @@ out_bydst: 


void xfrm_state_fini(struct net *net)

{

	struct xfrm_audit audit_info;

	unsigned int sz;



	flush_work(&net->xfrm.state_hash_work);

	audit_info.loginuid = -1;

	audit_info.sessionid = -1;

	audit_info.secid = 0;

	xfrm_state_flush(net, IPSEC_PROTO_ANY, &audit_info);

	flush_work(&net->xfrm.state_gc_work);



	WARN_ON(!list_empty(&net->xfrm.state_all));



	sz = (net->xfrm.state_hmask + 1) * sizeof(struct hlist_head);