lkml.org 
[lkml]   [2019]   [Feb]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v2] xfrm: policy: Fix possible user after free in __xfrm_policy_unlink
From
Date

On 2019/2/28 14:41, Herbert Xu wrote:
> On Thu, Feb 28, 2019 at 02:38:01PM +0800, Yue Haibing wrote:
>>
>> diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
>> index a131f9f..aaa45c9 100644
>> --- a/net/xfrm/xfrm_user.c
>> +++ b/net/xfrm/xfrm_user.c
>> @@ -1424,7 +1424,8 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
>> ret = verify_policy_dir(p->dir);
>> if (ret)
>> return ret;
>> - if (p->index && ((p->index & XFRM_POLICY_MAX) != p->dir))
>> + if (p->index && (((p->index & XFRM_POLICY_MAX) != p->dir) ||
>> + (xfrm_policy_id2dir(p->index) >= XFRM_POLICY_MAX)))
>
> Please just check
>
> xfrm_policy_id2dir(p->index) != p->dir


Oh, it indeed can be merged, Thanks!

>
> Thanks,
>

\
 
 \ /
  Last update: 2019-02-28 07:48    [W:4.703 / U:0.020 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site