From fcb8c156c8277ee9d71c8c81587d494c9c5240b3 Mon Sep 17 00:00:00 2001 From: Herbert Xu Date: Sun, 30 Dec 2007 21:09:38 -0800 Subject: [PATCH] [IPSEC]: Fix double free on skb on async output When the output transform returns EINPROGRESS due to async operation we'll free the skb the straight away as if it were an error. This patch fixes that so that the skb is freed when the async operation completes. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller --- net/xfrm/xfrm_output.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c index c1ba63efd7..81ad8eb2b2 100644 --- a/net/xfrm/xfrm_output.c +++ b/net/xfrm/xfrm_output.c @@ -78,6 +78,8 @@ static int xfrm_output_one(struct sk_buff *skb, int err) spin_unlock_bh(&x->lock); err = x->type->output(x, skb); + if (err == -EINPROGRESS) + goto out_exit; resume: if (err) { -- 2.39.5