diff options
| author | Xin Long <lucien.xin@gmail.com> | 2020-02-09 21:15:29 +0800 |
|---|---|---|
| committer | Steffen Klassert <steffen.klassert@secunet.com> | 2020-02-12 11:06:32 +0100 |
| commit | 171d449a028573b2f0acdc7f31ecbb045391b320 (patch) | |
| tree | c854c58aa283006d3beffbd69a608ce444c3fdaa /net/kcm/kcmproc.c | |
| parent | f1ed10264ed6b66b9cd5e8461cffce69be482356 (diff) | |
| download | linux-171d449a028573b2f0acdc7f31ecbb045391b320.tar.gz linux-171d449a028573b2f0acdc7f31ecbb045391b320.tar.bz2 linux-171d449a028573b2f0acdc7f31ecbb045391b320.zip | |
xfrm: fix uctx len check in verify_sec_ctx_len
It's not sufficient to do 'uctx->len != (sizeof(struct xfrm_user_sec_ctx) +
uctx->ctx_len)' check only, as uctx->len may be greater than nla_len(rt),
in which case it will cause slab-out-of-bounds when accessing uctx->ctx_str
later.
This patch is to fix it by return -EINVAL when uctx->len > nla_len(rt).
Fixes: df71837d5024 ("[LSM-IPSec]: Security association restriction.")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to 'net/kcm/kcmproc.c')
0 files changed, 0 insertions, 0 deletions