diff options
| author | Steffen Klassert <steffen.klassert@secunet.com> | 2018-08-01 13:45:11 +0200 |
|---|---|---|
| committer | Moyster <oysterized@gmail.com> | 2019-05-03 19:24:03 +0200 |
| commit | a8614988634e797604befa9c05fef0aa863cabc1 (patch) | |
| tree | 4d82243f24a40cb53b9e3bb97a5510dab7d3a835 /net | |
| parent | 770d5ebf73562194e1ab962768756a080722acb2 (diff) | |
xfrm: Validate address prefix lengths in the xfrm selector.
commit 07bf7908950a8b14e81aa1807e3c667eab39287a upstream.
We don't validate the address prefix lengths in the xfrm
selector we got from userspace. This can lead to undefined
behaviour in the address matching functions if the prefix
is too big for the given address family. Fix this by checking
the prefixes and refuse SA/policy insertation when a prefix
is invalid.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Change-Id: Ib965f595afaa6fba0c1d11241d7a6fbbb0e9a19c
Reported-by: Air Icy <icytxw@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'net')
| -rw-r--r-- | net/xfrm/xfrm_user.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 9d4261a4e..0d81c3b05 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -159,10 +159,16 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, err = -EINVAL; switch (p->family) { case AF_INET: + if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32) + goto out; + break; case AF_INET6: #if IS_ENABLED(CONFIG_IPV6) + if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128) + goto out; + break; #else err = -EAFNOSUPPORT; @@ -1217,10 +1223,16 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p) switch (p->sel.family) { case AF_INET: + if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32) + return -EINVAL; + break; case AF_INET6: #if IS_ENABLED(CONFIG_IPV6) + if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128) + return -EINVAL; + break; #else return -EAFNOSUPPORT; |