xfrm6 refcnt problem in bundle creation

Hi all,

I got a ref count problem in xfrm IPv6 part, but I don't really know what is the best way to fix it.

When xfrm6_fill_dst() is called, a dev is given as parameter:

static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
struct flowi *fl)

{
        struct rt6_info *rt = (struct rt6_info*)xdst->route;

        xdst->u.dst.dev = dev;
        dev_hold(dev);

        xdst->u.rt6.rt6i_idev = in6_dev_get(rt->u.dst.dev);
        if (!xdst->u.rt6.rt6i_idev)
                return -ENODEV;

[snip]

In my case, dev points to an ethernet device and the route (rt->u.dst.dev) points to a tunnel interface (ip6 over ip6). This function will get a ref on the idev of the tunnel (xdst->u.rt6.rt6i_idev = in6_dev_get(rt->u.dst.dev)), but dev of the dst is set to the ethernet interface (xdst->u.dst.dev = dev). After, when we try to remove the tunnel interface, the xfrm gc function will never check rt6i_idev, it will only check u.dst.dev, hence it will not remove the dst.
The consequence is that the interface cannot be removed.

IPv4 code takes the same dev to get idev, rather than using rt->u.dst.dev. Is it right to do the same in IPv6? A proposal patch is attached.

Code, before the patch of the bundle creation merge, takes 'rt->u.dst.dev' to get idev and to set dst.dev.

Suggestions are welcome.

Regards,
Nicolas

From: Nicolas Dichtel <[email protected]>
Date: Thu, 15 Apr 2010 18:27:30 +0200
Subject: [PATCH] xfrm6: ensure to use the same dev when building a bundle

When building a bundle, we set dst.dev and rt6.rt6i_idev. We must ensure to set the same device for both fields.

---
 net/ipv6/xfrm6_policy.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

index ae18165..00bf7c9 100644
@@ -124,7 +124,7 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
 	xdst->u.dst.dev = dev;
 	dev_hold(dev);
 
-	xdst->u.rt6.rt6i_idev = in6_dev_get(rt->u.dst.dev);
+	xdst->u.rt6.rt6i_idev = in6_dev_get(dev);
 	if (!xdst->u.rt6.rt6i_idev)
 		return -ENODEV;
 

1.5.4.5

From: Nicolas Dichtel <[email protected]>
Date: Thu, 15 Apr 2010 18:32:55 +0200

What we are doing now is definitely wrong and I think your patch is the correct fix.

Applied to net-2.6, thanks!