xfrm: fix uctx len check in verify_sec_ctx_len
commit5.4-rM2-2.2.x-imx-squashed171d449a02
upstream. It's not sufficient to do 'uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len)' check only, as uctx->len may be greater than nla_len(rt), in which case it will cause slab-out-of-bounds when accessing uctx->ctx_str later. This patch is to fix it by return -EINVAL when uctx->len > nla_len(rt). Fixes:df71837d50
("[LSM-IPSec]: Security association restriction.") Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
1b92d81d4c
commit
a5c5cf6f24
|
@ -110,7 +110,8 @@ static inline int verify_sec_ctx_len(struct nlattr **attrs)
|
|||
return 0;
|
||||
|
||||
uctx = nla_data(rt);
|
||||
if (uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len))
|
||||
if (uctx->len > nla_len(rt) ||
|
||||
uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len))
|
||||
return -EINVAL;
|
||||
|
||||
return 0;
|
||||
|
|
Loading…
Reference in New Issue