Message ID | 20190228063801.27200-1-yuehaibing@huawei.com |
---|---|
State | Awaiting Upstream |
Delegated to: | David Miller |
Headers | show |
Series | [v2] xfrm: policy: Fix possible user after free in __xfrm_policy_unlink | expand |
On Thu, Feb 28, 2019 at 02:38:01PM +0800, Yue Haibing wrote: > > diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c > index a131f9f..aaa45c9 100644 > --- a/net/xfrm/xfrm_user.c > +++ b/net/xfrm/xfrm_user.c > @@ -1424,7 +1424,8 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p) > ret = verify_policy_dir(p->dir); > if (ret) > return ret; > - if (p->index && ((p->index & XFRM_POLICY_MAX) != p->dir)) > + if (p->index && (((p->index & XFRM_POLICY_MAX) != p->dir) || > + (xfrm_policy_id2dir(p->index) >= XFRM_POLICY_MAX))) Please just check xfrm_policy_id2dir(p->index) != p->dir Thanks,
On 2019/2/28 14:41, Herbert Xu wrote: > On Thu, Feb 28, 2019 at 02:38:01PM +0800, Yue Haibing wrote: >> >> diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c >> index a131f9f..aaa45c9 100644 >> --- a/net/xfrm/xfrm_user.c >> +++ b/net/xfrm/xfrm_user.c >> @@ -1424,7 +1424,8 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p) >> ret = verify_policy_dir(p->dir); >> if (ret) >> return ret; >> - if (p->index && ((p->index & XFRM_POLICY_MAX) != p->dir)) >> + if (p->index && (((p->index & XFRM_POLICY_MAX) != p->dir) || >> + (xfrm_policy_id2dir(p->index) >= XFRM_POLICY_MAX))) > > Please just check > > xfrm_policy_id2dir(p->index) != p->dir Oh, it indeed can be merged, Thanks! > > Thanks, >
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index a131f9f..aaa45c9 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -1424,7 +1424,8 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p) ret = verify_policy_dir(p->dir); if (ret) return ret; - if (p->index && ((p->index & XFRM_POLICY_MAX) != p->dir)) + if (p->index && (((p->index & XFRM_POLICY_MAX) != p->dir) || + (xfrm_policy_id2dir(p->index) >= XFRM_POLICY_MAX))) return -EINVAL; return 0;