diff mbox series

[SRU,J:linux-bluefield,v2,1/6] net: af_key: fix sadb_x_filter validation

Message ID 1704454040-11017-2-git-send-email-yifeid@nvidia.com
State New
Headers show
Series Kernel panic in restart driver after configuring IPsec full offload | expand

Commit Message

Tony Duan Jan. 5, 2024, 11:27 a.m. UTC 
From: Lin Ma <linma@zju.edu.cn>

BugLink: https://bugs.launchpad.net/bugs/2044427

When running xfrm_state_walk_init(), the xfrm_address_filter being used
is okay to have a splen/dplen that equals to sizeof(xfrm_address_t)<<3.
This commit replaces >= to > to make sure the boundary checking is
correct.

Fixes: 37bd22420f85 ("af_key: pfkey_dump needs parameter validation")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
(cherry picked from commit 75065a8929069bc93181848818e23f147a73f83a)
Signed-off-by: Tony Duan <yifeid@nvidia.com>
---
 net/key/af_key.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/net/key/af_key.c b/net/key/af_key.c
index 7e45d7e..e62f1b9 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1848,9 +1848,9 @@  static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms
 	if (ext_hdrs[SADB_X_EXT_FILTER - 1]) {
 		struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1];
 
-		if ((xfilter->sadb_x_filter_splen >=
+		if ((xfilter->sadb_x_filter_splen >
 			(sizeof(xfrm_address_t) << 3)) ||
-		    (xfilter->sadb_x_filter_dplen >=
+		    (xfilter->sadb_x_filter_dplen >
 			(sizeof(xfrm_address_t) << 3))) {
 			mutex_unlock(&pfk->dump_lock);
 			return -EINVAL;