Merge git://git.infradead.org/users/eparis/audit

[~andy/linux] / net / xfrm / xfrm_policy.c

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 76e1873811d4cac098cd4d563e865e847997a4a4..0d49945d0b9eed2910d39a3485c3ad0c79166d87 100644 (file)
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1844,6 +1844,13 @@ static int xdst_queue_output(struct sk_buff *skb)
        struct xfrm_dst *xdst = (struct xfrm_dst *) dst;
        struct xfrm_policy *pol = xdst->pols[0];
        struct xfrm_policy_queue *pq = &pol->polq;
+       const struct sk_buff *fclone = skb + 1;
+
+       if (unlikely(skb->fclone == SKB_FCLONE_ORIG &&
+                    fclone->fclone == SKB_FCLONE_CLONE)) {
+               kfree_skb(skb);
+               return 0;
+       }
 
        if (pq->hold_queue.qlen > XFRM_MAX_QUEUE_LEN) {
                kfree_skb(skb);
@@ -2899,12 +2906,12 @@ static void xfrm_policy_fini(struct net *net)
        flush_work(&net->xfrm.policy_hash_work);
 #ifdef CONFIG_XFRM_SUB_POLICY
        audit_info.loginuid = INVALID_UID;
-       audit_info.sessionid = -1;
+       audit_info.sessionid = (unsigned int)-1;
        audit_info.secid = 0;
        xfrm_policy_flush(net, XFRM_POLICY_TYPE_SUB, &audit_info);
 #endif
        audit_info.loginuid = INVALID_UID;
-       audit_info.sessionid = -1;
+       audit_info.sessionid = (unsigned int)-1;
        audit_info.secid = 0;
        xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, &audit_info);
 
@@ -3010,7 +3017,7 @@ static void xfrm_audit_common_policyinfo(struct xfrm_policy *xp,
 }
 
 void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
-                          kuid_t auid, u32 sessionid, u32 secid)
+                          kuid_t auid, unsigned int sessionid, u32 secid)
 {
        struct audit_buffer *audit_buf;
 
@@ -3025,7 +3032,7 @@ void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
 EXPORT_SYMBOL_GPL(xfrm_audit_policy_add);
 
 void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
-                             kuid_t auid, u32 sessionid, u32 secid)
+                             kuid_t auid, unsigned int sessionid, u32 secid)
 {
        struct audit_buffer *audit_buf;