Re: BUG: dst underflow (again)

[Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>]

David S. Miller <davem@xxxxxxxxxxxxx> wrote:
> 
> Well, xfrm_lookup() is returning an error somehow, that's the only
> way to execute dst_release() in udpv6_sendmsg().  And xfrm_lookup()

Actually, there are other calls to dst_release in udpv6_sendmsg.  For
example, the inline function ip6_dst_store may call dst_release.

I'm afraid that we really have to audit all dst_release callers,
both direct and indirect, as well as all places where dst is stored.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt