| Message ID | 20180104112104.GA6437@gondor.apana.org.au |
|---|---|
| State | Awaiting Upstream, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | xfrm: Return error on unknown switch in init_state | expand |
On Thu, Jan 04, 2018 at 10:21:04PM +1100, Herbert Xu wrote: > Currently esp will happily create an xfrm state with an unknown > encap type for IPv4 or an unknown mode for IPv6, without setting > the necessary state parameters. This patch fixes it by returning > -EINVAL. Looks like we catch the unknown mode in __xfrm_init_state(). But in any case, if we want to return -EINVAL on unknown mode, we should do it for IPv6 and for IPv4.
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c index d57aa64..61fe6e4 100644 --- a/net/ipv4/esp4.c +++ b/net/ipv4/esp4.c @@ -981,6 +981,7 @@ static int esp_init_state(struct xfrm_state *x) switch (encap->encap_type) { default: + err = -EINVAL; goto error; case UDP_ENCAP_ESPINUDP: x->props.header_len += sizeof(struct udphdr); diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c index a902ff8..f2130ff 100644 --- a/net/ipv6/esp6.c +++ b/net/ipv6/esp6.c @@ -896,6 +896,7 @@ static int esp6_init_state(struct xfrm_state *x) x->props.header_len += sizeof(struct ipv6hdr); break; default: + err = -EINVAL; goto error; }
Currently esp will happily create an xfrm state with an unknown encap type for IPv4 or an unknown mode for IPv6, without setting the necessary state parameters. This patch fixes it by returning -EINVAL. Fixes: 38320c70d282 ("[IPSEC]: Use crypto_aead and authenc in ESP") Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>