mirror of
https://github.com/edk2-porting/linux-next.git
synced 2024-12-23 12:43:55 +08:00
xfrm: Validate address prefix lengths in the xfrm selector.
We don't validate the address prefix lengths in the xfrm
selector we got from userspace. This can lead to undefined
behaviour in the address matching functions if the prefix
is too big for the given address family. Fix this by checking
the prefixes and refuse SA/policy insertation when a prefix
is invalid.
Fixes: 1da177e4c3
("Linux-2.6.12-rc2")
Reported-by: Air Icy <icytxw@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
This commit is contained in:
parent
25432eba9c
commit
07bf790895
@ -151,10 +151,16 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
|
||||
err = -EINVAL;
|
||||
switch (p->family) {
|
||||
case AF_INET:
|
||||
if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
|
||||
goto out;
|
||||
|
||||
break;
|
||||
|
||||
case AF_INET6:
|
||||
#if IS_ENABLED(CONFIG_IPV6)
|
||||
if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128)
|
||||
goto out;
|
||||
|
||||
break;
|
||||
#else
|
||||
err = -EAFNOSUPPORT;
|
||||
@ -1359,10 +1365,16 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
|
||||
|
||||
switch (p->sel.family) {
|
||||
case AF_INET:
|
||||
if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
|
||||
return -EINVAL;
|
||||
|
||||
break;
|
||||
|
||||
case AF_INET6:
|
||||
#if IS_ENABLED(CONFIG_IPV6)
|
||||
if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128)
|
||||
return -EINVAL;
|
||||
|
||||
break;
|
||||
#else
|
||||
return -EAFNOSUPPORT;
|
||||
|
Loading…
Reference in New Issue
Block a user