diff options
Diffstat (limited to 'sys/netipsec/xform_esp.c')
| -rw-r--r-- | sys/netipsec/xform_esp.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/sys/netipsec/xform_esp.c b/sys/netipsec/xform_esp.c index 7aec10549e6c..be8c18da60b3 100644 --- a/sys/netipsec/xform_esp.c +++ b/sys/netipsec/xform_esp.c @@ -492,6 +492,7 @@ static int esp_input_cb(struct cryptop *crp) { IPSEC_DEBUG_DECLARE(char buf[128]); + struct rm_priotracker sahtree_tracker; uint8_t lastthree[3]; const struct auth_hash *esph; struct mbuf *m; @@ -507,6 +508,7 @@ esp_input_cb(struct cryptop *crp) xd = crp->crp_opaque; CURVNET_SET(xd->vnet); sav = xd->sav; + ipsec_sahtree_rlock(&sahtree_tracker); if (sav->state >= SADB_SASTATE_DEAD) { /* saidx is freed */ DPRINTF(("%s: dead SA %p spi %#x\n", __func__, sav, sav->spi)); @@ -527,6 +529,7 @@ esp_input_cb(struct cryptop *crp) if (ipsec_updateid(sav, &crp->crp_session, &cryptoid) != 0) crypto_freesession(cryptoid); xd->cryptoid = crp->crp_session; + ipsec_sahtree_runlock(&sahtree_tracker); CURVNET_RESTORE(); return (crypto_dispatch(crp)); } @@ -658,12 +661,14 @@ esp_input_cb(struct cryptop *crp) switch (saidx->dst.sa.sa_family) { #ifdef INET6 case AF_INET6: - error = ipsec6_common_input_cb(m, sav, skip, protoff); + error = ipsec6_common_input_cb(m, sav, skip, protoff, + &sahtree_tracker); break; #endif #ifdef INET case AF_INET: - error = ipsec4_common_input_cb(m, sav, skip, protoff); + error = ipsec4_common_input_cb(m, sav, skip, protoff, + &sahtree_tracker); break; #endif default: @@ -673,6 +678,7 @@ esp_input_cb(struct cryptop *crp) CURVNET_RESTORE(); return error; bad: + ipsec_sahtree_runlock(&sahtree_tracker); if (sav != NULL) key_freesav(&sav); if (m != NULL) |