diff options
| author |   Myungho Jung <mhjungk@gmail.com> | 2019-03-07 10:23:08 +0900 |
|---|---|---|
| committer |   Steffen Klassert <steffen.klassert@secunet.com> | 2019-03-08 07:32:16 +0100 |
| commit | 6ed69184ed9c43873b8a1ee721e3bf3c08c2c6be (patch) | |
| tree | a98a3ee9e14b9896bef16ea1b842d4d6c3f7ce8d /sound | |
| parent | xfrm: policy: Fix out-of-bound array accesses in __xfrm_policy_unlink (diff) | |
| download | linux-dev-6ed69184ed9c43873b8a1ee721e3bf3c08c2c6be.tar.xz linux-dev-6ed69184ed9c43873b8a1ee721e3bf3c08c2c6be.zip | |
xfrm: Reset secpath in xfrm failure
In esp4_gro_receive() and esp6_gro_receive(), secpath can be allocated
without adding xfrm state to xvec. Then, sp->xvec[sp->len - 1] would
fail and result in dereferencing invalid pointer in esp4_gso_segment()
and esp6_gso_segment(). Reset secpath if xfrm function returns error.
Fixes: 7785bba299a8 ("esp: Add a software GRO codepath")
Reported-by: syzbot+b69368fd933c6c592f4c@syzkaller.appspotmail.com
Signed-off-by: Myungho Jung <mhjungk@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to 'sound')
0 files changed, 0 insertions, 0 deletions