Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ccfde6e2 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec 



Steffen Klassert says:

====================
pull request (net): ipsec 2018-05-31

1) Avoid possible overflow of the offset variable
   in  _decode_session6(), this fixes an infinite
   lookp there. From Eric Dumazet.

2) We may use an error pointer in the error path of
   xfrm_bundle_create(). Fix this by returning this
   pointer directly to the caller.

Please pull or let me know if there are problems.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents a95691bc 38369f54

net/ipv6/xfrm6_policy.c

+1 −1
Original line number Diff line number Diff line
@@ -126,7 +126,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse) 
	struct flowi6 *fl6 = &fl->u.ip6;

	int onlyproto = 0;

	const struct ipv6hdr *hdr = ipv6_hdr(skb);

	u16 offset = sizeof(*hdr);

	u32 offset = sizeof(*hdr);

	struct ipv6_opt_hdr *exthdr;

	const unsigned char *nh = skb_network_header(skb);

	u16 nhoff = IP6CB(skb)->nhoff;

net/xfrm/xfrm_policy.c

+2 −3
Original line number Diff line number Diff line
@@ -1658,7 +1658,6 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy, 
		trailer_len -= xdst_prev->u.dst.xfrm->props.trailer_len;

	}



out:

	return &xdst0->u.dst;



put_states:
@@ -1667,8 +1666,8 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy, 
free_dst:

	if (xdst0)

		dst_release_immediate(&xdst0->u.dst);

	xdst0 = ERR_PTR(err);

	goto out;



	return ERR_PTR(err);

}



static int xfrm_expand_policies(const struct flowi *fl, u16 family,