Unverified Commit 9e44bdbf authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12155 bonding: Fix CVE-2024-44990 

Merge Pull Request from: @ci-robot 
 
PR sync from: Dong Chenchen <dongchenchen2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/Q6FUNN2Q6NWU6BD6QUTK6WHFHTGUDK3V/ 
bonding: Fix CVE-2024-44990

Nikolay Aleksandrov (2):
  bonding: fix bond_ipsec_offload_ok return type
  bonding: fix null pointer deref in bond_ipsec_offload_ok


-- 
2.25.1
 
https://gitee.com/src-openeuler/kernel/issues/IAOXZB 
 
Link:https://gitee.com/openeuler/kernel/pulls/12155

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents e2911e67 e1f746f6

drivers/net/bonding/bond_main.c

+8 −12
Original line number Diff line number Diff line
@@ -570,34 +570,30 @@ static bool bond_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *xs) 
	struct net_device *real_dev;

	struct slave *curr_active;

	struct bonding *bond;

	int err;

	bool ok = false;



	bond = netdev_priv(bond_dev);

	rcu_read_lock();

	curr_active = rcu_dereference(bond->curr_active_slave);

	if (!curr_active)

		goto out;

	real_dev = curr_active->dev;



	if (BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP) {

		err = false;

	if (BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP)

		goto out;

	}



	if (!xs->xso.real_dev) {

		err = false;

	if (!xs->xso.real_dev)

		goto out;

	}



	if (!real_dev->xfrmdev_ops ||

	    !real_dev->xfrmdev_ops->xdo_dev_offload_ok ||

	    netif_is_bond_master(real_dev)) {

		err = false;

	    netif_is_bond_master(real_dev))

		goto out;

	}



	err = real_dev->xfrmdev_ops->xdo_dev_offload_ok(skb, xs);

	ok = real_dev->xfrmdev_ops->xdo_dev_offload_ok(skb, xs);

out:

	rcu_read_unlock();

	return err;

	return ok;

}



static const struct xfrmdev_ops bond_xfrmdev_ops = {