Commit 3f5a95ad authored by Koichiro Den's avatar Koichiro Den Committed by Steffen Klassert
Browse files

xfrm: fix null pointer dereference on state and tmpl sort 



Creating sub policy that matches the same outer flow as main policy does
leads to a null pointer dereference if the outer mode's family is ipv4.
For userspace compatibility, this patch just eliminates the crash i.e.,
does not introduce any new sorting rule, which would fruitlessly affect
all but the aforementioned case.

Signed-off-by: default avatarKoichiro Den <den@klaipeden.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent e6194923

net/xfrm/xfrm_state.c

+8 −0
Original line number Diff line number Diff line
@@ -1620,6 +1620,7 @@ int 
xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,

	       unsigned short family, struct net *net)

{

	int i;

	int err = 0;

	struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);

	if (!afinfo)
@@ -1628,6 +1629,9 @@ xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, 
	spin_lock_bh(&net->xfrm.xfrm_state_lock); /*FIXME*/

	if (afinfo->tmpl_sort)

		err = afinfo->tmpl_sort(dst, src, n);

	else

		for (i = 0; i < n; i++)

			dst[i] = src[i];

	spin_unlock_bh(&net->xfrm.xfrm_state_lock);

	rcu_read_unlock();

	return err;
@@ -1638,6 +1642,7 @@ int 
xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,

		unsigned short family)

{

	int i;

	int err = 0;

	struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);

	struct net *net = xs_net(*src);
@@ -1648,6 +1653,9 @@ xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n, 
	spin_lock_bh(&net->xfrm.xfrm_state_lock);

	if (afinfo->state_sort)

		err = afinfo->state_sort(dst, src, n);

	else

		for (i = 0; i < n; i++)

			dst[i] = src[i];

	spin_unlock_bh(&net->xfrm.xfrm_state_lock);

	rcu_read_unlock();

	return err;

CRA Git | Maintained and supported by SUSTech CRA and CCSE