diff options
| author | Herbert Xu <herbert@gondor.apana.org.au> | 2017-04-13 18:35:59 +0800 |
|---|---|---|
| committer | Pat Tjin <pattjin@google.com> | 2017-07-24 20:51:02 +0000 |
| commit | 33ebe944be73d7eef354300266d42df693e33438 (patch) | |
| tree | 45c663bf9fda779d019d84fcca9e6ed5ff3181fa /include/linux/dma-contiguous.h | |
| parent | 939568f95bc140d1ceb99d24e5c4001d2ffa75e4 (diff) | |
| download | x86_64-33ebe944be73d7eef354300266d42df693e33438.tar.gz | |
UPSTREAM: af_key: Fix sadb_x_ipsecrequest parsing
(cherry picked from commit 096f41d3a8fcbb8dde7f71379b1ca85fe213eded)
The parsing of sadb_x_ipsecrequest is broken in a number of ways.
First of all we're not verifying sadb_x_ipsecrequest_len. This
is needed when the structure carries addresses at the end. Worse
we don't even look at the length when we parse those optional
addresses.
The migration code had similar parsing code that's better but
it also has some deficiencies. The length is overcounted first
of all as it includes the header itself. It also fails to check
the length before dereferencing the sa_family field.
This patch fixes those problems in parse_sockaddr_pair and then
uses it in parse_ipsecrequest.
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Bug: 63963140
Change-Id: Ie8854131293bc8153bfb8cb255161ec8f03667f9
Diffstat (limited to 'include/linux/dma-contiguous.h')
0 files changed, 0 insertions, 0 deletions