diff options
author | Myungho Jung <mhjungk@gmail.com> | 2019-03-07 10:23:08 +0900 |
---|---|---|
committer | Steffen Klassert <steffen.klassert@secunet.com> | 2019-03-08 07:32:16 +0100 |
commit | 6ed69184ed9c43873b8a1ee721e3bf3c08c2c6be (patch) | |
tree | a98a3ee9e14b9896bef16ea1b842d4d6c3f7ce8d /mm/Makefile | |
parent | xfrm: policy: Fix out-of-bound array accesses in __xfrm_policy_unlink (diff) | |
download | linux-dev-6ed69184ed9c43873b8a1ee721e3bf3c08c2c6be.tar.xz linux-dev-6ed69184ed9c43873b8a1ee721e3bf3c08c2c6be.zip |
xfrm: Reset secpath in xfrm failure
In esp4_gro_receive() and esp6_gro_receive(), secpath can be allocated
without adding xfrm state to xvec. Then, sp->xvec[sp->len - 1] would
fail and result in dereferencing invalid pointer in esp4_gso_segment()
and esp6_gso_segment(). Reset secpath if xfrm function returns error.
Fixes: 7785bba299a8 ("esp: Add a software GRO codepath")
Reported-by: syzbot+b69368fd933c6c592f4c@syzkaller.appspotmail.com
Signed-off-by: Myungho Jung <mhjungk@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to 'mm/Makefile')
0 files changed, 0 insertions, 0 deletions