diff options
Diffstat (limited to 'main/linux-virt-grsec/ipsec-xfrm-properly-handle-invalid-states-as-an-error.patch')
| -rw-r--r-- | main/linux-virt-grsec/ipsec-xfrm-properly-handle-invalid-states-as-an-error.patch | 44 |
1 files changed, 44 insertions, 0 deletions
diff --git a/main/linux-virt-grsec/ipsec-xfrm-properly-handle-invalid-states-as-an-error.patch b/main/linux-virt-grsec/ipsec-xfrm-properly-handle-invalid-states-as-an-error.patch new file mode 100644 index 000000000..7cb0dade7 --- /dev/null +++ b/main/linux-virt-grsec/ipsec-xfrm-properly-handle-invalid-states-as-an-error.patch @@ -0,0 +1,44 @@ +From patchwork Wed May 22 11:40:47 2013 +Content-Type: text/plain; charset="utf-8" +MIME-Version: 1.0 +Content-Transfer-Encoding: 8bit +Subject: [ipsec] xfrm: properly handle invalid states as an error +Date: Wed, 22 May 2013 01:40:47 -0000 +From: =?utf-8?q?Timo_Ter=C3=A4s?= <timo.teras@iki.fi> +X-Patchwork-Id: 245594 +Message-Id: <1369222847-8542-1-git-send-email-timo.teras@iki.fi> +To: netdev@vger.kernel.org +Cc: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>, + Li RongQing <roy.qing.li@gmail.com>, + Steffen Klassert <steffen.klassert@secunet.com> + +The error exit path needs err explicitly set. Otherwise it +returns success and the only caller, xfrm_output_resume(), +would oops in skb_dst(skb)->ops derefence as skb_dst(skb) is +NULL. + +Bug introduced in commit bb65a9cb (xfrm: removes a superfluous +check and add a statistic). + +Signed-off-by: Timo Teräs <timo.teras@iki.fi> +Cc: Li RongQing <roy.qing.li@gmail.com> +Cc: Steffen Klassert <steffen.klassert@secunet.com> + +--- +Should go also to 3.9-stable. + + net/xfrm/xfrm_output.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c +index bcfda89..0cf003d 100644 +--- a/net/xfrm/xfrm_output.c ++++ b/net/xfrm/xfrm_output.c +@@ -64,6 +64,7 @@ static int xfrm_output_one(struct sk_buff *skb, int err) + + if (unlikely(x->km.state != XFRM_STATE_VALID)) { + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEINVALID); ++ err = -EINVAL; + goto error; + } + |