mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-11-23 20:24:12 +08:00
[IPSEC]: Fixed alg_key_len usage in attach_one_algo
The variable alg_key_len is in bits and not bytes. The function attach_one_algo is currently using it as if it were in bytes. This causes it to read memory which may not be there. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
8be58932ca
commit
b9e9dead05
@ -162,6 +162,7 @@ static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
|
||||
struct rtattr *rta = u_arg;
|
||||
struct xfrm_algo *p, *ualg;
|
||||
struct xfrm_algo_desc *algo;
|
||||
int len;
|
||||
|
||||
if (!rta)
|
||||
return 0;
|
||||
@ -173,11 +174,12 @@ static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
|
||||
return -ENOSYS;
|
||||
*props = algo->desc.sadb_alg_id;
|
||||
|
||||
p = kmalloc(sizeof(*ualg) + ualg->alg_key_len, GFP_KERNEL);
|
||||
len = sizeof(*ualg) + (ualg->alg_key_len + 7U) / 8;
|
||||
p = kmalloc(len, GFP_KERNEL);
|
||||
if (!p)
|
||||
return -ENOMEM;
|
||||
|
||||
memcpy(p, ualg, sizeof(*ualg) + ualg->alg_key_len);
|
||||
memcpy(p, ualg, len);
|
||||
*algpp = p;
|
||||
return 0;
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user