Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b9e9dead authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller
Browse files

[IPSEC]: Fixed alg_key_len usage in attach_one_algo 



The variable alg_key_len is in bits and not bytes.  The function
attach_one_algo is currently using it as if it were in bytes.
This causes it to read memory which may not be there.

Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8be58932

net/xfrm/xfrm_user.c

+4 −2
Original line number Diff line number Diff line
@@ -162,6 +162,7 @@ static int attach_one_algo(struct xfrm_algo **algpp, u8 *props, 
	struct rtattr *rta = u_arg;

	struct xfrm_algo *p, *ualg;

	struct xfrm_algo_desc *algo;

	int len;



	if (!rta)

		return 0;
@@ -173,11 +174,12 @@ static int attach_one_algo(struct xfrm_algo **algpp, u8 *props, 
		return -ENOSYS;

	*props = algo->desc.sadb_alg_id;



	p = kmalloc(sizeof(*ualg) + ualg->alg_key_len, GFP_KERNEL);

	len = sizeof(*ualg) + (ualg->alg_key_len + 7U) / 8;

	p = kmalloc(len, GFP_KERNEL);

	if (!p)

		return -ENOMEM;



	memcpy(p, ualg, sizeof(*ualg) + ualg->alg_key_len);

	memcpy(p, ualg, len);

	*algpp = p;

	return 0;

}