Herbert Xu wrote:

On Wed, Sep 03, 2008 at 08:07:33AM +0300, Timo Teräs wrote:

quoted

Right. Also alternatively the xfrm_state_all could be protected
by a different lock than xfrm_state_lock.

Yes that's a good idea.  Here's a patch to do that for states.
I'm still thinking about whether policy destruction should be
restructured or not so I'm not patching that.

ipsec: Move state dump list unlinking into GC

This patch moves the unlinking of x->all (for dumping) into the
GC and changes the lock to xfrm_cfg_mutex.

Shouldn't this also change the locking in all places where
x->all is used?