Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e2b19125 authored by Steffen Klassert's avatar Steffen Klassert Committed by David S. Miller
Browse files

xfrm: Check for esn buffer len in xfrm_new_ae 



In xfrm_new_ae() we may overwrite the allocated esn replay state
buffer with a wrong size. So check that the new size matches the
original allocated size and return an error if this is not the case.

Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
Acked-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent af2f464e

net/xfrm/xfrm_user.c

+21 −0
Original line number Diff line number Diff line
@@ -360,6 +360,23 @@ static int attach_aead(struct xfrm_algo_aead **algpp, u8 *props, 
	return 0;

}



static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_esn,

					 struct nlattr *rp)

{

	struct xfrm_replay_state_esn *up;



	if (!replay_esn || !rp)

		return 0;



	up = nla_data(rp);



	if (xfrm_replay_state_esn_len(replay_esn) !=

			xfrm_replay_state_esn_len(up))

		return -EINVAL;



	return 0;

}



static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn,

				       struct xfrm_replay_state_esn **preplay_esn,

				       struct nlattr *rta)
@@ -1766,6 +1783,10 @@ static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh, 
	if (x->km.state != XFRM_STATE_VALID)

		goto out;



	err = xfrm_replay_verify_len(x->replay_esn, rp);

	if (err)

		goto out;



	spin_lock_bh(&x->lock);

	xfrm_update_ae_params(x, attrs);

	spin_unlock_bh(&x->lock);