| commit | cf265c64c91957fd0f1b86b7427028d823966d74 | |
| author | Xin Long <lucien.xin@gmail.com> | |
| Sun, 9 Feb 2020 13:15:29 +0000 (9 21:15 +0800) | ||
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
| Thu, 2 Apr 2020 13:28:18 +0000 (2 15:28 +0200) | ||
| tree | d1be38999864abeaa1999479548142697bb44a0a | treesnapshot (tar.gz zip) |
| parent | 2eb46d0044849a70c796e3646a6ce50e5a69a992 | commitdiff |
xfrm: fix uctx len check in verify_sec_ctx_len
commit 171d449a028573b2f0acdc7f31ecbb045391b320 upstream.
It's not sufficient to do 'uctx->len != (sizeof(struct xfrm_user_sec_ctx) +
uctx->ctx_len)' check only, as uctx->len may be greater than nla_len(rt),
in which case it will cause slab-out-of-bounds when accessing uctx->ctx_str
later.
This patch is to fix it by return -EINVAL when uctx->len > nla_len(rt).
Fixes: df71837d5024 ("[LSM-IPSec]: Security association restriction.")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 171d449a028573b2f0acdc7f31ecbb045391b320 upstream.
It's not sufficient to do 'uctx->len != (sizeof(struct xfrm_user_sec_ctx) +
uctx->ctx_len)' check only, as uctx->len may be greater than nla_len(rt),
in which case it will cause slab-out-of-bounds when accessing uctx->ctx_str
later.
This patch is to fix it by return -EINVAL when uctx->len > nla_len(rt).
Fixes: df71837d5024 ("[LSM-IPSec]: Security association restriction.")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| net/xfrm/xfrm_user.c | diffblobblamehistory |