On Tue, Jul 31, 2018 at 08:16:22PM +0900, Tetsuo Handa wrote:

Steffen and Herbert,

Do you have any question? I think I provided enough information for debugging.

It seems that I was not on Cc at the beginning of the threat,
so I had to search the web for some context.

I'm currently trying your reproducer (still with my .config) but I don't
hit the problem.

This problem occurs because two dev_put() calls are missing (compared with not
calling setsockopt(SOL_IPV6, IPV6_XFRM_POLICY)) because dst_release() is not
called via fib6_info_destroy_rcu() when we called xfrm_compile_policy() from
xfrm_user_policy() from setsockopt(SOL_IPV6, IPV6_XFRM_POLICY).

Thanks for the information! As said, I'm already working on it.