Commit edb666f0 authored by Steffen Klassert's avatar Steffen Klassert
Browse files

xfrm6: Properly handle unsupported protocols 



We don't catch the case if an unsupported protocol is submitted
to the xfrm6 protocol handlers, this can lead to NULL pointer
dereferences. Fix this by adding the appropriate checks.

Fixes: 7e14ea15 ("xfrm6: Add IPsec protocol multiplexer")
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent 61622cc6

net/ipv6/xfrm6_protocol.c

+10 −1
Original line number Diff line number Diff line
@@ -50,6 +50,10 @@ int xfrm6_rcv_cb(struct sk_buff *skb, u8 protocol, int err) 
{

	int ret;

	struct xfrm6_protocol *handler;

	struct xfrm6_protocol __rcu **head = proto_handlers(protocol);



	if (!head)

		return 0;



	for_each_protocol_rcu(*proto_handlers(protocol), handler)

		if ((ret = handler->cb_handler(skb, err)) <= 0)
@@ -184,10 +188,12 @@ int xfrm6_protocol_register(struct xfrm6_protocol *handler, 
	struct xfrm6_protocol __rcu **pprev;

	struct xfrm6_protocol *t;

	bool add_netproto = false;



	int ret = -EEXIST;

	int priority = handler->priority;



	if (!proto_handlers(protocol) || !netproto(protocol))

		return -EINVAL;



	mutex_lock(&xfrm6_protocol_mutex);



	if (!rcu_dereference_protected(*proto_handlers(protocol),
@@ -230,6 +236,9 @@ int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, 
	struct xfrm6_protocol *t;

	int ret = -ENOENT;



	if (!proto_handlers(protocol) || !netproto(protocol))

		return -EINVAL;



	mutex_lock(&xfrm6_protocol_mutex);



	for (pprev = proto_handlers(protocol);

CRA Git | Maintained and supported by SUSTech CRA and CCSE