xfrm_user: uncoditionally validate esn replay attribute struct
commit d97ca5d714a5334aecadadf696875da40f1fbf3e upstream. The sanity test added inecd7918745
can be bypassed, validation only occurs if XFRM_STATE_ESN flag is set, but rest of code doesn't care and just checks if the attribute itself is present. So always validate. Alternative is to reject if we have the attribute without the flag but that would change abi. Reported-by: syzbot+0ab777c27d2bb7588f73@syzkaller.appspotmail.com Cc: Mathias Krause <minipli@googlemail.com> Fixes:ecd7918745
("xfrm_user: ensure user supplied esn replay window is valid") Fixes:d8647b79c3
("xfrm: Add user interface for esn and big anti-replay windows") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
f70030993f
commit
c469a67980
|
@ -125,22 +125,17 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
|
|||
struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
|
||||
struct xfrm_replay_state_esn *rs;
|
||||
|
||||
if (p->flags & XFRM_STATE_ESN) {
|
||||
if (!rt)
|
||||
return -EINVAL;
|
||||
|
||||
rs = nla_data(rt);
|
||||
|
||||
if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8)
|
||||
return -EINVAL;
|
||||
|
||||
if (nla_len(rt) < xfrm_replay_state_esn_len(rs) &&
|
||||
nla_len(rt) != sizeof(*rs))
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (!rt)
|
||||
return 0;
|
||||
return (p->flags & XFRM_STATE_ESN) ? -EINVAL : 0;
|
||||
|
||||
rs = nla_data(rt);
|
||||
|
||||
if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8)
|
||||
return -EINVAL;
|
||||
|
||||
if (nla_len(rt) < xfrm_replay_state_esn_len(rs) &&
|
||||
nla_len(rt) != sizeof(*rs))
|
||||
return -EINVAL;
|
||||
|
||||
if (p->id.proto != IPPROTO_ESP)
|
||||
return -EINVAL;
|
||||
|
|
Loading…
Reference in New Issue