diff options
| author | Paul Moore <pmoore@redhat.com> | 2013-05-29 11:36:25 +0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2013-06-01 04:30:07 +0400 |
| commit | e4c1721642bbd42d8142f4811cde0588c28db51d (patch) | |
| tree | 8f7750f6065dcb5d2bd727174fb9f4e3cd8fccf3 /net/key | |
| parent | 1e2bd517c108816220f262d7954b697af03b5f9c (diff) | |
| download | linux-e4c1721642bbd42d8142f4811cde0588c28db51d.tar.xz | |
xfrm: force a garbage collection after deleting a policy
In some cases after deleting a policy from the SPD the policy would
remain in the dst/flow/route cache for an extended period of time
which caused problems for SELinux as its dynamic network access
controls key off of the number of XFRM policy and state entries.
This patch corrects this problem by forcing a XFRM garbage collection
whenever a policy is sucessfully removed.
Reported-by: Ondrej Moris <omoris@redhat.com>
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/key')
| -rw-r--r-- | net/key/af_key.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/key/af_key.c b/net/key/af_key.c index 5b1e5af25713..c5fbd7589681 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -2366,6 +2366,8 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, const struct sa out: xfrm_pol_put(xp); + if (err == 0) + xfrm_garbage_collect(net); return err; } @@ -2615,6 +2617,8 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, const struct sadb_ out: xfrm_pol_put(xp); + if (delete && err == 0) + xfrm_garbage_collect(net); return err; } |