]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
xfrm4: Fix uninitialized memory read in _decode_session4
authorSteffen Klassert <steffen.klassert@secunet.com>
Tue, 26 Feb 2019 06:04:50 +0000 (07:04 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 11 Jun 2019 10:23:49 +0000 (12:23 +0200)
commitfe4f461ba51729796c96b9d3ff797a5e585547d6
treede1edf268d112fb8270ba969eb83377347f72a52
parentcd0848733f2596fe9c27100e5bd031aff5117c22
xfrm4: Fix uninitialized memory read in _decode_session4

[ Upstream commit 8742dc86d0c7a9628117a989c11f04a9b6b898f3 ]

We currently don't reload pointers pointing into skb header
after doing pskb_may_pull() in _decode_session4(). So in case
pskb_may_pull() changed the pointers, we read from random
memory. Fix this by putting all the needed infos on the
stack, so that we don't need to access the header pointers
after doing pskb_may_pull().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/ipv4/xfrm4_policy.c