Commit 5d8dbb7f authored by Pavel Skripkin's avatar Pavel Skripkin Committed by Steffen Klassert
Browse files

net: xfrm: fix shift-out-of-bounce 



We need to check up->dirmask to avoid shift-out-of-bounce bug,
since up->dirmask comes from userspace.

Also, added XFRM_USERPOLICY_DIRMASK_MAX constant to uapi to inform
user-space that up->dirmask has maximum possible value

Fixes: 2d151d39 ("xfrm: Add possibility to set the default to block if we have no policy")
Reported-and-tested-by: default avatar <syzbot+9cd5837a045bbee5b810@syzkaller.appspotmail.com>
Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent 2d151d39

include/uapi/linux/xfrm.h

+1 −0
Original line number Diff line number Diff line
@@ -514,6 +514,7 @@ struct xfrm_user_offload { 
#define XFRM_OFFLOAD_INBOUND	2



struct xfrm_userpolicy_default {

#define XFRM_USERPOLICY_DIRMASK_MAX	(sizeof(__u8) * 8)

	__u8				dirmask;

	__u8				action;

};

net/xfrm/xfrm_user.c

+6 −1
Original line number Diff line number Diff line
@@ -1966,9 +1966,14 @@ static int xfrm_set_default(struct sk_buff *skb, struct nlmsghdr *nlh, 
{

	struct net *net = sock_net(skb->sk);

	struct xfrm_userpolicy_default *up = nlmsg_data(nlh);

	u8 dirmask = (1 << up->dirmask) & XFRM_POL_DEFAULT_MASK;

	u8 dirmask;

	u8 old_default = net->xfrm.policy_default;



	if (up->dirmask >= XFRM_USERPOLICY_DIRMASK_MAX)

		return -EINVAL;



	dirmask = (1 << up->dirmask) & XFRM_POL_DEFAULT_MASK;



	net->xfrm.policy_default = (old_default & (0xff ^ dirmask))

				    | (up->action << up->dirmask);