From: Steffen Klassert <steffen.klassert@secunet•com>
To: David Miller <davem@davemloft•net>,
Herbert Xu <herbert@gondor•apana.org.au>
Cc: netdev@vger•kernel.org
Subject: [PATCH 3/4] xfrm: Check for esn buffer len in xfrm_new_ae
Date: Tue, 29 Mar 2011 07:47:30 +0200 [thread overview]
Message-ID: <20110329054730.GK1290@secunet.com> (raw)
In-Reply-To: <20110329054552.GI1290@secunet.com>
In xfrm_new_ae() we may overwrite the allocated esn replay state
buffer with a wrong size. So check that the new size matches the
original allocated size and return an error if this is not the case.
Signed-off-by: Steffen Klassert <steffen.klassert@secunet•com>
---
net/xfrm/xfrm_user.c | 21 +++++++++++++++++++++
1 files changed, 21 insertions(+), 0 deletions(-)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index fc152d2..ccc4c0c 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -360,6 +360,23 @@ static int attach_aead(struct xfrm_algo_aead **algpp, u8 *props,
return 0;
}
+static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_esn,
+ struct nlattr *rp)
+{
+ struct xfrm_replay_state_esn *up;
+
+ if (!replay_esn || !rp)
+ return 0;
+
+ up = nla_data(rp);
+
+ if (xfrm_replay_state_esn_len(replay_esn) !=
+ xfrm_replay_state_esn_len(up))
+ return -EINVAL;
+
+ return 0;
+}
+
static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn,
struct xfrm_replay_state_esn **preplay_esn,
struct nlattr *rta)
@@ -1766,6 +1783,10 @@ static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
if (x->km.state != XFRM_STATE_VALID)
goto out;
+ err = xfrm_replay_verify_len(x->replay_esn, rp);
+ if (err)
+ goto out;
+
spin_lock_bh(&x->lock);
xfrm_update_ae_params(x, attrs);
spin_unlock_bh(&x->lock);
--
1.7.0.4
next prev parent reply other threads:[~2011-03-29 5:47 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-03-29 5:45 [PATCH 1/4] xfrm: Move the test on replay window size into the replay check functions Steffen Klassert
2011-03-29 5:46 ` [PATCH 2/4] xfrm: Assign esn pointers when cloning a state Steffen Klassert
2011-03-29 5:47 ` Steffen Klassert [this message]
2011-03-29 5:48 ` [PATCH 4/4] xfrm: Restrict extended sequence numbers to esp Steffen Klassert
2011-03-29 6:20 ` [PATCH 1/4] xfrm: Move the test on replay window size into the replay check functions Herbert Xu
2011-03-29 6:48 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110329054730.GK1290@secunet.com \
--to=steffen.klassert@secunet$(echo .)com \
--cc=davem@davemloft$(echo .)net \
--cc=herbert@gondor$(echo .)apana.org.au \
--cc=netdev@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox