Re: IPSec: Policy dst bundles exhausting storage

["David S. Miller" <davem@xxxxxxxxxx>]

   From: Tom Lendacky <toml@xxxxxxxxxx>
   Date: 11 Jun 2003 12:20:33 -0500

   As for the bug though, it appears that the "x->u.rt.fl = *fl"
   statement shouldn't be performed in the IPv6 __xfrm6_bundle_create
   function.

I have a better suggestion for fix:

1) Delete the "x->u.rt.fl = *fl;" line completely.

2) Fix the test in __xfrm6_find_bundle() to do a proper
   prefix-mask based address comparison.

   rt6->rt6i_{dst,src} are masked addresses, so direct
   comparison is wrong.

Can someone code this up?
Thanks.