Commit f398035f authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller

[IPSEC]: Avoid undefined shift operation when testing algorithm ID

The aalgos/ealgos fields are only 32 bits wide.  However, af_key tries
to test them with the expression 1 << id where id can be as large as
253.  This produces different behaviour on different architectures.

The following patch explicitly checks whether ID is greater than 31
and fails the check if that's the case.

We cannot easily extend the mask to be longer than 32 bits due to
exposure to user-space.  Besides, this whole interface is obsolete
anyway in favour of the xfrm_user interface which doesn't use this
bit mask in templates (well not within the kernel anyway).
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e0260fed
...@@ -2784,12 +2784,22 @@ static struct sadb_msg *pfkey_get_base_msg(struct sk_buff *skb, int *errp) ...@@ -2784,12 +2784,22 @@ static struct sadb_msg *pfkey_get_base_msg(struct sk_buff *skb, int *errp)
static inline int aalg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d) static inline int aalg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d)
{ {
return t->aalgos & (1 << d->desc.sadb_alg_id); unsigned int id = d->desc.sadb_alg_id;
if (id >= sizeof(t->aalgos) * 8)
return 0;
return (t->aalgos >> id) & 1;
} }
static inline int ealg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d) static inline int ealg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d)
{ {
return t->ealgos & (1 << d->desc.sadb_alg_id); unsigned int id = d->desc.sadb_alg_id;
if (id >= sizeof(t->ealgos) * 8)
return 0;
return (t->ealgos >> id) & 1;
} }
static int count_ah_combs(struct xfrm_tmpl *t) static int count_ah_combs(struct xfrm_tmpl *t)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment