From 5474d440b8a26b30104329d699217c87d34652ad Mon Sep 17 00:00:00 2001 From: Thomas Egerer Date: Mon, 30 Oct 2017 19:11:45 +0100 Subject: [PATCH] xfrm_policy: Do not attempt to deleteall a socket policy Socket polices are added to a socket using setsockopt(2). They cannot be deleted by iproute2. The attempt to delete them causes an error (EINVAL). To avoid this unnecessary error message all socket policies are skipped in xfrm_policy_keep. Signed-off-by: Thomas Egerer --- ip/xfrm_policy.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ip/xfrm_policy.c b/ip/xfrm_policy.c index 0c86a52a..e716a7d0 100644 --- a/ip/xfrm_policy.c +++ b/ip/xfrm_policy.c @@ -735,6 +735,10 @@ static int xfrm_policy_keep(const struct sockaddr_nl *who, if (!xfrm_policy_filter_match(xpinfo, ptype)) return 0; + /* can't delete socket policies */ + if (xpinfo->dir >= XFRM_POLICY_MAX) + return 0; + if (xb->offset + NLMSG_LENGTH(sizeof(*xpid)) > xb->size) return 0;