Unverified Commit 6388829d authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12156 bonding: Fix CVE-2024-44990 

Merge Pull Request from: @ci-robot 
 
PR sync from: Dong Chenchen <dongchenchen2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/ZEF3DIGPEWPVU25ZRS4KB45VM36SRXS2/ 
bonding: Fix CVE-2024-44990

Nikolay Aleksandrov (2):
  bonding: fix bond_ipsec_offload_ok return type
  bonding: fix null pointer deref in bond_ipsec_offload_ok


-- 
2.25.1
 
https://gitee.com/src-openeuler/kernel/issues/IAOXZB 
 
Link:https://gitee.com/openeuler/kernel/pulls/12156
parents b56d5e4b 8ed4264b

drivers/net/bonding/bond_main.c

+8 −12
Original line number Diff line number Diff line
@@ -557,34 +557,30 @@ static bool bond_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *xs) 
	struct net_device *real_dev;

	struct slave *curr_active;

	struct bonding *bond;

	int err;

	bool ok = false;



	bond = netdev_priv(bond_dev);

	rcu_read_lock();

	curr_active = rcu_dereference(bond->curr_active_slave);

	if (!curr_active)

		goto out;

	real_dev = curr_active->dev;



	if (BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP) {

		err = false;

	if (BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP)

		goto out;

	}



	if (!xs->xso.real_dev) {

		err = false;

	if (!xs->xso.real_dev)

		goto out;

	}



	if (!real_dev->xfrmdev_ops ||

	    !real_dev->xfrmdev_ops->xdo_dev_offload_ok ||

	    netif_is_bond_master(real_dev)) {

		err = false;

	    netif_is_bond_master(real_dev))

		goto out;

	}



	err = real_dev->xfrmdev_ops->xdo_dev_offload_ok(skb, xs);

	ok = real_dev->xfrmdev_ops->xdo_dev_offload_ok(skb, xs);

out:

	rcu_read_unlock();

	return err;

	return ok;

}



static const struct xfrmdev_ops bond_xfrmdev_ops = {