On Thu, Sep 08, 2016 at 06:09:57PM +0200, Mathias Krause wrote:
> When we fail to attach the security context in xfrm_state_construct()
> we'll return 0 as error value which, in turn, will wrongly claim success
> to userland when, in fact, we won't be adding / updating the XFRM state.
>
> This is a regression introduced by commit fd21150a0fe1 ("[XFRM] netlink:
> Inline attach_encap_tmpl(), attach_sec_ctx(), and attach_one_addr()").
>
> Fix it by propagating the error returned by security_xfrm_state_alloc()
> in this case.
>
> Fixes: fd21150a0fe1 ("[XFRM] netlink: Inline attach_encap_tmpl()...")
> Signed-off-by: Mathias Krause <mini...@googlemail.com>
Applied to the ipsec tree, thanks Mathias!
