 out_hdr = (struct sadb_msg *) out_skb->data; out_hdr->sadb_msg_version = hdr->sadb_msg_version; out_hdr->sadb_msg_type = hdr->sadb_msg_type; out_hdr->sadb_msg_satype = 0; out_hdr->sadb_msg_errno = 0; out_hdr->sadb_msg_seq = hdr->sadb_msg_seq; out_hdr->sadb_msg_pid = hdr->sadb_msg_pid; pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, sk); 
static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs){	int err;	struct sadb_lifetime *lifetime;	struct sadb_address *sa;	struct sadb_x_policy *pol;	struct xfrm_policy *xp;	struct sk_buff *out_skb;	struct sadb_msg *out_hdr;	if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],				     ext_hdrs[SADB_EXT_ADDRESS_DST-1]) ||	    !ext_hdrs[SADB_X_EXT_POLICY-1])		return -EINVAL;	pol = ext_hdrs[SADB_X_EXT_POLICY-1];	if (pol->sadb_x_policy_type > IPSEC_POLICY_IPSEC)		return -EINVAL;	if (!pol->sadb_x_policy_dir || pol->sadb_x_policy_dir >= IPSEC_DIR_MAX)		return -EINVAL;	xp = xfrm_policy_alloc(GFP_KERNEL);	if (xp == NULL)		return -ENOBUFS;	xp->action = (pol->sadb_x_policy_type == IPSEC_POLICY_DISCARD ?		      XFRM_POLICY_BLOCK : XFRM_POLICY_ALLOW);	xp->priority = pol->sadb_x_policy_priority;	sa = ext_hdrs[SADB_EXT_ADDRESS_SRC-1], 	xp->family = pfkey_sadb_addr2xfrm_addr(sa, &xp->selector.saddr);	if (!xp->family) {		err = -EINVAL;		goto out;	}	xp->selector.family = xp->family;	xp->selector.prefixlen_s = sa->sadb_address_prefixlen;	xp->selector.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto);	xp->selector.sport = ((struct sockaddr_in *)(sa+1))->sin_port;	if (xp->selector.sport)		xp->selector.sport_mask = ~0;	sa = ext_hdrs[SADB_EXT_ADDRESS_DST-1], 	pfkey_sadb_addr2xfrm_addr(sa, &xp->selector.daddr);	xp->selector.prefixlen_d = sa->sadb_address_prefixlen;	/* Amusing, we set this twice.  KAME apps appear to set same value	 * in both addresses.	 */	xp->selector.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto);	xp->selector.dport = ((struct sockaddr_in *)(sa+1))->sin_port;	if (xp->selector.dport)		xp->selector.dport_mask = ~0;	xp->lft.soft_byte_limit = XFRM_INF;	xp->lft.hard_byte_limit = XFRM_INF;	xp->lft.soft_packet_limit = XFRM_INF;	xp->lft.hard_packet_limit = XFRM_INF;	if ((lifetime = ext_hdrs[SADB_EXT_LIFETIME_HARD-1]) != NULL) {		xp->lft.hard_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations);		xp->lft.hard_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes);		xp->lft.hard_add_expires_seconds = lifetime->sadb_lifetime_addtime;		xp->lft.hard_use_expires_seconds = lifetime->sadb_lifetime_usetime;	}	if ((lifetime = ext_hdrs[SADB_EXT_LIFETIME_SOFT-1]) != NULL) {		xp->lft.soft_packet_limit = _KEY2X(lifetime->sadb_lifetime_allocations);		xp->lft.soft_byte_limit = _KEY2X(lifetime->sadb_lifetime_bytes);		xp->lft.soft_add_expires_seconds = lifetime->sadb_lifetime_addtime;		xp->lft.soft_use_expires_seconds = lifetime->sadb_lifetime_usetime;	}	xp->xfrm_nr = 0;	if (pol->sadb_x_policy_type == IPSEC_POLICY_IPSEC &&	    (err = parse_ipsecrequests(xp, pol)) < 0)		goto out;	out_skb = pfkey_xfrm_policy2msg_prep(xp);	if (IS_ERR(out_skb)) {		err =  PTR_ERR(out_skb);		goto out;	}	err = xfrm_policy_insert(pol->sadb_x_policy_dir-1, xp,				 hdr->sadb_msg_type != SADB_X_SPDUPDATE);	if (err) {		kfree_skb(out_skb);		goto out;	}	pfkey_xfrm_policy2msg(out_skb, xp, pol->sadb_x_policy_dir-1);	xfrm_pol_put(xp);	out_hdr = (struct sadb_msg *) out_skb->data;	out_hdr->sadb_msg_version = hdr->sadb_msg_version;	out_hdr->sadb_msg_type = hdr->sadb_msg_type;	out_hdr->sadb_msg_satype = 0;	out_hdr->sadb_msg_errno = 0;	out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;	out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;	pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, sk);	return 0;out:	kfree(xp);	return err;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/26b15dad9f1c19d6d4f7b999b07eaa6d98e4b375/af_key.c/buggy/net/key/af_key.c