Patchwork [3.8.y.z,extended,stable] Patch "xfrm6: release dev before returning error" has been added to staging queue

mail settings
Submitter Kamal Mostafa
Date May 24, 2013, 5:38 p.m.
Message ID <>
Download mbox | patch
Permalink /patch/246249/
State New
Headers show


Kamal Mostafa - May 24, 2013, 5:38 p.m.
This is a note to let you know that I have just added a patch titled

    xfrm6: release dev before returning error

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.8.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see



From e9e1fb7e1737f31873ccad360b7be6d4f013e653 Mon Sep 17 00:00:00 2001
From: Cong Wang <>
Date: Thu, 9 May 2013 22:40:00 +0000
Subject: xfrm6: release dev before returning error

[ Upstream commit 84c4a9dfbf430861e7588d95ae3ff61535dca351 ]

We forget to call dev_put() on error path in xfrm6_fill_dst(),
its caller doesn't handle this.

Cc: Herbert Xu <>
Cc: Steffen Klassert <>
Cc: David S. Miller <>
Signed-off-by: Cong Wang <>
Signed-off-by: David S. Miller <>
Signed-off-by: Kamal Mostafa <>
 net/ipv6/xfrm6_policy.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)



diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 8f32718..0ee0ab5 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -103,8 +103,10 @@  static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,

 	xdst->u.rt6.rt6i_idev = in6_dev_get(dev);
-	if (!xdst->u.rt6.rt6i_idev)
+	if (!xdst->u.rt6.rt6i_idev) {
+		dev_put(dev);
 		return -ENODEV;
+	}

 	rt6_transfer_peer(&xdst->u.rt6, rt);