Subject: Re: [IPSEC]: Avoid undefined shift operation when testing algorithm ID

From: David Miller <[email-masked]>
Date: Wed, 19 Dec 2007 23:44:55 -0800 (PST)

From: Herbert Xu <[email-masked]>
Date: Thu, 20 Dec 2007 12:29:37 +0800

> [IPSEC]: Avoid undefined shift operation when testing algorithm ID
> 
> The aalgos/ealgos fields are only 32 bits wide.  However, af_key tries
> to test them with the expression 1 << id where id can be as large as
> 253.  This produces different behaviour on different architectures.
> 
> The following patch explicitly checks whether ID is greater than 31
> and fails the check if that's the case.
> 
> We cannot easily extend the mask to be longer than 32 bits due to
> exposure to user-space.  Besides, this whole interface is obsolete
> anyway in favour of the xfrm_user interface which doesn't use this
> bit mask in templates (well not within the kernel anyway).
> 
> Signed-off-by: Herbert Xu <[email-masked]>

Thanks for fixing this bug, patch applied!