Skip to content
Commit d97ca5d7 authored by Florian Westphal's avatar Florian Westphal Committed by Steffen Klassert
Browse files

xfrm_user: uncoditionally validate esn replay attribute struct

The sanity test added in ecd79187

 can be bypassed, validation
only occurs if XFRM_STATE_ESN flag is set, but rest of code doesn't care
and just checks if the attribute itself is present.

So always validate.  Alternative is to reject if we have the attribute
without the flag but that would change abi.

Reported-by: default avatar <syzbot+0ab777c27d2bb7588f73@syzkaller.appspotmail.com>
Cc: Mathias Krause <minipli@googlemail.com>
Fixes: ecd79187 ("xfrm_user: ensure user supplied esn replay window is valid")
Fixes: d8647b79

 ("xfrm: Add user interface for esn and big anti-replay windows")
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent 2471c981
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment