Messages in this thread | | | Subject | Re: [PATCH v2] xfrm: policy: Fix possible user after free in __xfrm_policy_unlink | From | YueHaibing <> | Date | Thu, 28 Feb 2019 14:48:17 +0800 |
| |
On 2019/2/28 14:41, Herbert Xu wrote: > On Thu, Feb 28, 2019 at 02:38:01PM +0800, Yue Haibing wrote: >> >> diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c >> index a131f9f..aaa45c9 100644 >> --- a/net/xfrm/xfrm_user.c >> +++ b/net/xfrm/xfrm_user.c >> @@ -1424,7 +1424,8 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p) >> ret = verify_policy_dir(p->dir); >> if (ret) >> return ret; >> - if (p->index && ((p->index & XFRM_POLICY_MAX) != p->dir)) >> + if (p->index && (((p->index & XFRM_POLICY_MAX) != p->dir) || >> + (xfrm_policy_id2dir(p->index) >= XFRM_POLICY_MAX))) > > Please just check > > xfrm_policy_id2dir(p->index) != p->dir
Oh, it indeed can be merged, Thanks!
> > Thanks, >
| |