Merge "xfrm: Fix stack-out-of-bounds read on socket policy lookup." (8d91b553) · Commits · e / devices / android_kernel_sony_msm8998

net/xfrm/xfrm_policy.c

+7 −1

Original line number	Diff line number	Diff line
		@@ -1223,9 +1223,15 @@ static struct xfrm_policy xfrm_sk_policy_lookup(const struct sock sk, int dir,
		read_lock_bh(&net->xfrm.xfrm_policy_lock);
		pol = rcu_dereference(sk->sk_policy[dir]);
		if (pol != NULL) {
		bool match = xfrm_selector_match(&pol->selector, fl, family);
		bool match;
		int err = 0;

		if (pol->family != family) {
		pol = NULL;
		goto out;
		}

		match = xfrm_selector_match(&pol->selector, fl, family);
		if (match) {
		if ((sk->sk_mark & pol->mark.m) != pol->mark.v) {
		pol = NULL;