From 2b0eb0d099b1562985e459d55db2cf109c2dd779 Mon Sep 17 00:00:00 2001 From: Chris Wright Date: Wed, 27 Jul 2005 14:27:51 -0700 Subject: [PATCH] Add ipsec overflow patch fwd from DaveM. --- queue/ipsec-array-overflow.patch | 34 ++++++++++++++++++++++++++++++++ queue/series | 1 + 2 files changed, 35 insertions(+) create mode 100644 queue/ipsec-array-overflow.patch diff --git a/queue/ipsec-array-overflow.patch b/queue/ipsec-array-overflow.patch new file mode 100644 index 00000000000..165e1e75e82 --- /dev/null +++ b/queue/ipsec-array-overflow.patch @@ -0,0 +1,34 @@ +From stable-bounces@linux.kernel.org Tue Jul 26 16:40:13 2005 +Date: Tue, 26 Jul 2005 16:40:31 -0700 (PDT) +To: stable@kernel.org +From: "David S. Miller" +Subject: [PATCH][XFRM]: Fix possible overflow of sock->sk_policy + +From: Herbert Xu + +[XFRM]: Fix possible overflow of sock->sk_policy + +Spotted by, and original patch by, Balazs Scheidler. + +Signed-off-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Chris Wright +--- + + net/xfrm/xfrm_user.c | 3 +++ + 1 files changed, 3 insertions(+) + +Index: linux-2.6.12.y/net/xfrm/xfrm_user.c +=================================================================== +--- linux-2.6.12.y.orig/net/xfrm/xfrm_user.c ++++ linux-2.6.12.y/net/xfrm/xfrm_user.c +@@ -1180,6 +1180,9 @@ static struct xfrm_policy *xfrm_compile_ + if (nr > XFRM_MAX_DEPTH) + return NULL; + ++ if (p->dir > XFRM_POLICY_OUT) ++ return NULL; ++ + xp = xfrm_policy_alloc(GFP_KERNEL); + if (xp == NULL) { + *dir = -ENOBUFS; diff --git a/queue/series b/queue/series index 6adb897d3cf..3a640fbaf22 100644 --- a/queue/series +++ b/queue/series @@ -6,3 +6,4 @@ skb-signedness-fix.patch netfilter-deadlock-ip6_queue.patch netfilter-NAT-memory-corruption.patch netfilter-ip_conntrack_untracked-refcount.patch +ipsec-array-overflow.patch -- 2.47.3