Steffen Klassert says: ==================== pull request (net): ipsec 2018-05-31 1) Avoid possible overflow of the offset variable in _decode_session6(), this fixes an infinite lookp there. From Eric Dumazet. 2) We may use an error pointer in the error path of xfrm_bundle_create(). Fix this by returning this pointer directly to the caller. Please pull or let me know if there are problems. ====================
Unified · Split
| @@ -126,7 +126,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse) · 125 unmodified lines | ||
| 126 | 126 | struct flowi6 *fl6 = &fl->u.ip6; |
| 127 | 127 | int onlyproto = 0; |
| 128 | 128 | const struct ipv6hdr *hdr = ipv6_hdr(skb); |
| 129 | − u16 offset = sizeof(*hdr); | |
| 129 | + u32 offset = sizeof(*hdr); | |
| 130 | 130 | struct ipv6_opt_hdr *exthdr; |
| 131 | 131 | const unsigned char *nh = skb_network_header(skb); |
| 132 | 132 | u16 nhoff = IP6CB(skb)->nhoff; |
| @@ -1658,7 +1658,6 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy, · 1657 unmodified lines | ||
| 1658 | 1658 | trailer_len -= xdst_prev->u.dst.xfrm->props.trailer_len; |
| 1659 | 1659 | } |
| 1660 | 1660 | |
| 1661 | −out: | |
| 1662 | 1661 | return &xdst0->u.dst; |
| 1663 | 1662 | |
| 1664 | 1663 | put_states: |
| @@ -1667,8 +1666,8 @@ put_states: · 2 unmodified lines | ||
| 1667 | 1666 | free_dst: |
| 1668 | 1667 | if (xdst0) |
| 1669 | 1668 | dst_release_immediate(&xdst0->u.dst); |
| 1670 | − xdst0 = ERR_PTR(err); | |
| 1671 | − goto out; | |
| 1669 | + | |
| 1670 | + return ERR_PTR(err); | |
| 1672 | 1671 | } |
| 1673 | 1672 | |
| 1674 | 1673 | static int xfrm_expand_policies(const struct flowi *fl, u16 family, |