]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
af_key: Fix slab-out-of-bounds in pfkey_compile_policy.
authorSteffen Klassert <steffen.klassert@secunet.com>
Fri, 5 May 2017 05:40:42 +0000 (07:40 +0200)
committerSasha Levin <alexander.levin@microsoft.com>
Wed, 23 May 2018 01:36:22 +0000 (21:36 -0400)
commit4734188068bf9de8c61ee0e5b456ab0647a17d9f
tree3bf7aac7f034e32365364ef8840e4794909f802e
parentd8453c025d9386158c29678955eee25b8e365d69
af_key: Fix slab-out-of-bounds in pfkey_compile_policy.

[ Upstream commit d90c902449a7561f1b1d58ba5a0d11728ce8b0b2 ]

The sadb_x_sec_len is stored in the unit 'byte divided by eight'.
So we have to multiply this value by eight before we can do
size checks. Otherwise we may get a slab-out-of-bounds when
we memcpy the user sec_ctx.

Fixes: df71837d502 ("[LSM-IPSec]: Security association restriction.")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
net/key/af_key.c