Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3f5a95ad authored by Koichiro Den's avatar Koichiro Den Committed by Steffen Klassert
Browse files

xfrm: fix null pointer dereference on state and tmpl sort 



Creating sub policy that matches the same outer flow as main policy does
leads to a null pointer dereference if the outer mode's family is ipv4.
For userspace compatibility, this patch just eliminates the crash i.e.,
does not introduce any new sorting rule, which would fruitlessly affect
all but the aforementioned case.

Signed-off-by: default avatarKoichiro Den <den@klaipeden.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent e6194923

net/xfrm/xfrm_state.c

+8 −0
Original line number Original line Diff line number Diff line
@@ -1620,6 +1620,7 @@ int 
xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,

xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,

	       unsigned short family, struct net *net)

	       unsigned short family, struct net *net)

{

{

	int i;

	int err = 0;

	int err = 0;

	struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);

	struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);

	if (!afinfo)

	if (!afinfo)
@@ -1628,6 +1629,9 @@ xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, 
	spin_lock_bh(&net->xfrm.xfrm_state_lock); /*FIXME*/

	spin_lock_bh(&net->xfrm.xfrm_state_lock); /*FIXME*/

	if (afinfo->tmpl_sort)

	if (afinfo->tmpl_sort)

		err = afinfo->tmpl_sort(dst, src, n);

		err = afinfo->tmpl_sort(dst, src, n);

	else

		for (i = 0; i < n; i++)

			dst[i] = src[i];

	spin_unlock_bh(&net->xfrm.xfrm_state_lock);

	spin_unlock_bh(&net->xfrm.xfrm_state_lock);

	rcu_read_unlock();

	rcu_read_unlock();

	return err;

	return err;
@@ -1638,6 +1642,7 @@ int 
xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,

xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,

		unsigned short family)

		unsigned short family)

{

{

	int i;

	int err = 0;

	int err = 0;

	struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);

	struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);

	struct net *net = xs_net(*src);

	struct net *net = xs_net(*src);
@@ -1648,6 +1653,9 @@ xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n, 
	spin_lock_bh(&net->xfrm.xfrm_state_lock);

	spin_lock_bh(&net->xfrm.xfrm_state_lock);

	if (afinfo->state_sort)

	if (afinfo->state_sort)

		err = afinfo->state_sort(dst, src, n);

		err = afinfo->state_sort(dst, src, n);

	else

		for (i = 0; i < n; i++)

			dst[i] = src[i];

	spin_unlock_bh(&net->xfrm.xfrm_state_lock);

	spin_unlock_bh(&net->xfrm.xfrm_state_lock);

	rcu_read_unlock();

	rcu_read_unlock();

	return err;

	return err;