(usagi-users 02963) ipv6/udp.c

[Ken-ichirou MATSUZAWA <chamas@xxxxxxxxxxxxx>]

 Hello.
I don't know detail, but is it right? in 2.6.6

---- net/ipv6/udp.c: udpv6_mcast_deliver ----
	if (buff)
		kfree_skb(buff);
	if (udpv6_queue_rcv_skb(sk, skb) < 0) {
free_skb:
		kfree_skb(skb);
	}
	read_unlock(&udp_hash_lock);
}

---- net/ipv6/udp.c: udpv6_queue_rcv_skb ----
	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
		kfree_skb(skb);
		return -1;
	}

----

It seems kfree_skb twice.

I tried racoon configuring require ipsec for all packet exclude a few.
When linux box receives RIPng packets, it oops. Is it related to this?