Commit 3f5a95ad authored by Koichiro Den's avatar Koichiro Den Committed by Steffen Klassert

xfrm: fix null pointer dereference on state and tmpl sort

Creating sub policy that matches the same outer flow as main policy does
leads to a null pointer dereference if the outer mode's family is ipv4.
For userspace compatibility, this patch just eliminates the crash i.e.,
does not introduce any new sorting rule, which would fruitlessly affect
all but the aforementioned case.
Signed-off-by: default avatarKoichiro Den <den@klaipeden.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent e6194923
...@@ -1620,6 +1620,7 @@ int ...@@ -1620,6 +1620,7 @@ int
xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
unsigned short family, struct net *net) unsigned short family, struct net *net)
{ {
int i;
int err = 0; int err = 0;
struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
if (!afinfo) if (!afinfo)
...@@ -1628,6 +1629,9 @@ xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, ...@@ -1628,6 +1629,9 @@ xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
spin_lock_bh(&net->xfrm.xfrm_state_lock); /*FIXME*/ spin_lock_bh(&net->xfrm.xfrm_state_lock); /*FIXME*/
if (afinfo->tmpl_sort) if (afinfo->tmpl_sort)
err = afinfo->tmpl_sort(dst, src, n); err = afinfo->tmpl_sort(dst, src, n);
else
for (i = 0; i < n; i++)
dst[i] = src[i];
spin_unlock_bh(&net->xfrm.xfrm_state_lock); spin_unlock_bh(&net->xfrm.xfrm_state_lock);
rcu_read_unlock(); rcu_read_unlock();
return err; return err;
...@@ -1638,6 +1642,7 @@ int ...@@ -1638,6 +1642,7 @@ int
xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n, xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
unsigned short family) unsigned short family)
{ {
int i;
int err = 0; int err = 0;
struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family); struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
struct net *net = xs_net(*src); struct net *net = xs_net(*src);
...@@ -1648,6 +1653,9 @@ xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n, ...@@ -1648,6 +1653,9 @@ xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
spin_lock_bh(&net->xfrm.xfrm_state_lock); spin_lock_bh(&net->xfrm.xfrm_state_lock);
if (afinfo->state_sort) if (afinfo->state_sort)
err = afinfo->state_sort(dst, src, n); err = afinfo->state_sort(dst, src, n);
else
for (i = 0; i < n; i++)
dst[i] = src[i];
spin_unlock_bh(&net->xfrm.xfrm_state_lock); spin_unlock_bh(&net->xfrm.xfrm_state_lock);
rcu_read_unlock(); rcu_read_unlock();
return err; return err;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment