Commit 1ba5bf99 authored Jul 05, 2016 by Vegard Nossum Committed by Steffen Klassert Jul 18, 2016

xfrm: fix crash in XFRM_MSG_GETSA netlink handler



If we hit any of the error conditions inside xfrm_dump_sa(), then
xfrm_state_walk_init() never gets called. However, we still call
xfrm_state_walk_done() from xfrm_dump_sa_done(), which will crash
because the state walk was never initialized properly.

We can fix this by setting cb->args[0] only after we've processed the
first element and checking this before calling xfrm_state_walk_done().

Fixes: d3623099 ("ipsec: add support of limited SA dump")
Cc: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

parent 8e6ce7eb

net/xfrm/xfrm_user.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -896,6 +896,7 @@ static int xfrm_dump_sa_done(struct netlink_callback *cb)
		struct sock *sk = cb->skb->sk;
		struct net *net = sock_net(sk);

		if (cb->args[0])
		xfrm_state_walk_done(walk, net);
		return 0;
		}
		@@ -921,8 +922,6 @@ static int xfrm_dump_sa(struct sk_buff skb, struct netlink_callback cb)
		u8 proto = 0;
		int err;

		cb->args[0] = 1;

		err = nlmsg_parse(cb->nlh, 0, attrs, XFRMA_MAX,
		xfrma_policy);
		if (err < 0)
		@@ -939,6 +938,7 @@ static int xfrm_dump_sa(struct sk_buff skb, struct netlink_callback cb)
		proto = nla_get_u8(attrs[XFRMA_PROTO]);

		xfrm_state_walk_init(walk, proto, filter);
		cb->args[0] = 1;
		}

		(void) xfrm_state_walk(net, walk, dump_one_state, &info);

Admin message