]> git.baikalelectronics.ru Git - kernel.git/commit
xfrm_user: uncoditionally validate esn replay attribute struct
authorFlorian Westphal <fw@strlen.de>
Mon, 12 Feb 2018 13:42:01 +0000 (14:42 +0100)
committerSteffen Klassert <steffen.klassert@secunet.com>
Tue, 13 Feb 2018 08:12:09 +0000 (09:12 +0100)
commitfed3c783b6d4d48c31fb6b78e522258ee309a451
tree6bbb65e655aca87c6fc27289673cd3ffe005147a
parent5136b94ef7a3a06361d980b3a2413184105b54f6
xfrm_user: uncoditionally validate esn replay attribute struct

The sanity test added in c1dce08f4205a can be bypassed, validation
only occurs if XFRM_STATE_ESN flag is set, but rest of code doesn't care
and just checks if the attribute itself is present.

So always validate.  Alternative is to reject if we have the attribute
without the flag but that would change abi.

Reported-by: syzbot+0ab777c27d2bb7588f73@syzkaller.appspotmail.com
Cc: Mathias Krause <minipli@googlemail.com>
Fixes: c1dce08f4205a ("xfrm_user: ensure user supplied esn replay window is valid")
Fixes: 9e6c072da8f5c ("xfrm: Add user interface for esn and big anti-replay windows")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
net/xfrm/xfrm_user.c