Remove the check if x->km.state equal to XFRM_STATE_VALID in xfrm_state_check_expire(), which will be done before call xfrm_state_check_expire(). add a LINUX_MIB_XFRMOUTSTATEINVALID statistic to record the outbound error due to invalid xfrm state.
Unified · Split
| @@ -278,6 +278,7 @@ enum · 277 unmodified lines | |||
| 278 | LINUX_MIB_XFRMOUTPOLDEAD, /* XfrmOutPolDead */ | 278 | LINUX_MIB_XFRMOUTPOLDEAD, /* XfrmOutPolDead */ |
| 279 | LINUX_MIB_XFRMOUTPOLERROR, /* XfrmOutPolError */ | 279 | LINUX_MIB_XFRMOUTPOLERROR, /* XfrmOutPolError */ |
| 280 | LINUX_MIB_XFRMFWDHDRERROR, /* XfrmFwdHdrError*/ | 280 | LINUX_MIB_XFRMFWDHDRERROR, /* XfrmFwdHdrError*/ |
| 281 | LINUX_MIB_XFRMOUTSTATEINVALID, /* XfrmOutStateInvalid */ | ||
| 281 | __LINUX_MIB_XFRMMAX | 282 | __LINUX_MIB_XFRMMAX |
| 282 | }; | 283 | }; |
| 283 | 284 | ||
| @@ -61,6 +61,12 @@ static int xfrm_output_one(struct sk_buff *skb, int err) · 60 unmodified lines | |||
| 61 | } | 61 | } |
| 62 | 62 | ||
| 63 | spin_lock_bh(&x->lock); | 63 | spin_lock_bh(&x->lock); |
| 64 | |||
| 65 | if (unlikely(x->km.state != XFRM_STATE_VALID)) { | ||
| 66 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEINVALID); | ||
| 67 | goto error_nolock; | ||
| 68 | } | ||
| 69 | |||
| 64 | err = xfrm_state_check_expire(x); | 70 | err = xfrm_state_check_expire(x); |
| 65 | if (err) { | 71 | if (err) { |
| 66 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEEXPIRED); | 72 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEEXPIRED); |
| @@ -43,6 +43,7 @@ static const struct snmp_mib xfrm_mib_list[] = { · 42 unmodified lines | |||
| 43 | SNMP_MIB_ITEM("XfrmOutPolDead", LINUX_MIB_XFRMOUTPOLDEAD), | 43 | SNMP_MIB_ITEM("XfrmOutPolDead", LINUX_MIB_XFRMOUTPOLDEAD), |
| 44 | SNMP_MIB_ITEM("XfrmOutPolError", LINUX_MIB_XFRMOUTPOLERROR), | 44 | SNMP_MIB_ITEM("XfrmOutPolError", LINUX_MIB_XFRMOUTPOLERROR), |
| 45 | SNMP_MIB_ITEM("XfrmFwdHdrError", LINUX_MIB_XFRMFWDHDRERROR), | 45 | SNMP_MIB_ITEM("XfrmFwdHdrError", LINUX_MIB_XFRMFWDHDRERROR), |
| 46 | SNMP_MIB_ITEM("XfrmOutStateInvalid", LINUX_MIB_XFRMOUTSTATEINVALID), | ||
| 46 | SNMP_MIB_SENTINEL | 47 | SNMP_MIB_SENTINEL |
| 47 | }; | 48 | }; |
| 48 | 49 | ||
| @@ -1370,9 +1370,6 @@ int xfrm_state_check_expire(struct xfrm_state *x) · 1369 unmodified lines | |||
| 1370 | if (!x->curlft.use_time) | 1370 | if (!x->curlft.use_time) |
| 1371 | x->curlft.use_time = get_seconds(); | 1371 | x->curlft.use_time = get_seconds(); |
| 1372 | 1372 | ||
| 1373 | if (x->km.state != XFRM_STATE_VALID) | ||
| 1374 | return -EINVAL; | ||
| 1375 | |||
| 1376 | if (x->curlft.bytes >= x->lft.hard_byte_limit || | 1373 | if (x->curlft.bytes >= x->lft.hard_byte_limit || |
| 1377 | x->curlft.packets >= x->lft.hard_packet_limit) { | 1374 | x->curlft.packets >= x->lft.hard_packet_limit) { |
| 1378 | x->km.state = XFRM_STATE_EXPIRED; | 1375 | x->km.state = XFRM_STATE_EXPIRED; |