>Number:         25368
>Category:       kern
>Synopsis:       crash after SADB_X_SPDFLUSH
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Apr 28 18:39:00 UTC 2004
>Closed-Date:
>Last-Modified:
>Originator:     YAMAMOTO Takashi <yamt@mwd.biglobe.ne.jp>
>Release:        NetBSD 2.0E
>Organization:

>Environment:
	
	
System: NetBSD kaeru 2.0E NetBSD 2.0E (build.kaeru) #1242: Thu Apr 29 02:52:16 JST 2004 takashi@kaeru:/home/takashi/work/kernel/build.kaeru i386
Architecture: i386
Machine: i386
>Description:
	key_spdflush() iterates sptailq and calls key_sp_unlink() for
	each policies.  thus per-pcb policies are freed without clearing
	corresponding sp_in/out.
	system will crash when the sp_in/out is touched later.

	i think other by-id operations like SADB_X_SPDDELETE2 have
	the same problem.
>How-To-Repeat:
>Fix:
	prevent pfkey from modifying per-pcb policies?

>Release-Note:
>Audit-Trail:
>Unformatted: