Steffen Klassert says: ==================== pull request (net): ipsec 2018-05-31 1) Avoid possible overflow of the offset variable in _decode_session6(), this fixes an infinite lookp there. From Eric Dumazet. 2) We may use an error pointer in the error path of xfrm_bundle_create(). Fix this by returning this pointer directly to the caller. Please pull or let me know if there are problems. ====================
Unified · Split
| @@ -126,7 +126,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse) · 125 unmodified lines | |||
| 126 | struct flowi6 *fl6 = &fl->u.ip6; | 126 | struct flowi6 *fl6 = &fl->u.ip6; |
| 127 | int onlyproto = 0; | 127 | int onlyproto = 0; |
| 128 | const struct ipv6hdr *hdr = ipv6_hdr(skb); | 128 | const struct ipv6hdr *hdr = ipv6_hdr(skb); |
| 129 | u16 offset = sizeof(*hdr); | 129 | u32 offset = sizeof(*hdr); |
| 130 | struct ipv6_opt_hdr *exthdr; | 130 | struct ipv6_opt_hdr *exthdr; |
| 131 | const unsigned char *nh = skb_network_header(skb); | 131 | const unsigned char *nh = skb_network_header(skb); |
| 132 | u16 nhoff = IP6CB(skb)->nhoff; | 132 | u16 nhoff = IP6CB(skb)->nhoff; |
| @@ -1658,7 +1658,6 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy, · 1657 unmodified lines | |||
| 1658 | trailer_len -= xdst_prev->u.dst.xfrm->props.trailer_len; | 1658 | trailer_len -= xdst_prev->u.dst.xfrm->props.trailer_len; |
| 1659 | } | 1659 | } |
| 1660 | 1660 | ||
| 1661 | out: | ||
| 1662 | return &xdst0->u.dst; | 1661 | return &xdst0->u.dst; |
| 1663 | 1662 | ||
| 1664 | put_states: | 1663 | put_states: |
| @@ -1667,8 +1666,8 @@ put_states: · 2 unmodified lines | |||
| 1667 | free_dst: | 1666 | free_dst: |
| 1668 | if (xdst0) | 1667 | if (xdst0) |
| 1669 | dst_release_immediate(&xdst0->u.dst); | 1668 | dst_release_immediate(&xdst0->u.dst); |
| 1670 | xdst0 = ERR_PTR(err); | 1669 | |
| 1671 | goto out; | 1670 | return ERR_PTR(err); |
| 1672 | } | 1671 | } |
| 1673 | 1672 | ||
| 1674 | static int xfrm_expand_policies(const struct flowi *fl, u16 family, | 1673 | static int xfrm_expand_policies(const struct flowi *fl, u16 family, |