Skip to contentSkip to conversation

xfrm: check trunc_len in XFRMA_ALG_AUTH_TRUNC

PATCH Applied Nicolas Dichtel 2 participants 2 messages Jan 11, 2011

Subsystems (3)
Networking Network drivers Networking IPsec
lore
Share & tools
lore

Nicolas Dichtel

author
#0 lore raw

PATCH 1/1 xfrm: check trunc_len in XFRMA_ALG_AUTH_TRUNC

Hi,

patch is attached.

Regards,
Nicolas

Quoted 1 line

From 48dd29c69f150fc55bf3a477b9365d1575a9cfbe Mon Sep 17 00:00:00 2001

From: Nicolas Dichtel <[email protected]>
Date: Tue, 11 Jan 2011 13:23:51 -0500
Subject: [PATCH] xfrm: check trunc_len in XFRMA_ALG_AUTH_TRUNC

Maximum trunc length is defined by MAX_AH_AUTH_LEN (in bytes) and need to be checked when this value is set (in bits) by the user. In ah4.c and ah6.c a BUG_ON() checks this condiftion.

Signed-off-by Nicolas Dichtel <[email protected]>
---
 net/xfrm/xfrm_user.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)
net/xfrm/xfrm_user.c +3 -1
index 8bae6b2..b45288f 100644
@@ -26,6 +26,7 @@
 #include <net/sock.h>
 #include <net/xfrm.h>
 #include <net/netlink.h>
+#include <net/ah.h>
 #include <asm/uaccess.h>
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 #include <linux/in6.h>

@@ -296,7 +297,8 @@ static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props,
 	algo = xfrm_aalg_get_byname(ualg->alg_name, 1);
 	if (!algo)
 		return -ENOSYS;
-	if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits)
+	if ((ualg->alg_trunc_len / 8) > MAX_AH_AUTH_LEN ||
+	    ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits)
 		return -EINVAL;
 	*props = algo->desc.sadb_alg_id;
Signature · 1 line
1.5.6.5
maintainer Applied
#1 lore raw

From: Nicolas Dichtel <[email protected]>
Date: Tue, 11 Jan 2011 19:04:12 +0100

Quoted 10 lines
Quoted 1 line

From 48dd29c69f150fc55bf3a477b9365d1575a9cfbe Mon Sep 17 00:00:00 2001

From: Nicolas Dichtel <[email protected]>
Date: Tue, 11 Jan 2011 13:23:51 -0500
Subject: [PATCH] xfrm: check trunc_len in XFRMA_ALG_AUTH_TRUNC

Maximum trunc length is defined by MAX_AH_AUTH_LEN (in bytes) and need to be checked when this value is set (in bits) by the user. In ah4.c and ah6.c a BUG_ON() checks this condiftion.

Signed-off-by Nicolas Dichtel <[email protected]>

Applied.