diff options
| author | Timo Teräs <timo.teras@iki.fi> | 2010-03-31 00:17:04 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2010-04-01 19:41:35 -0700 |
| commit | c8bf4d04f970fafb3430d332533e1cf103f2a018 (patch) | |
| tree | 5d0a7507da01350b64fe182d7906bc0d85166f8b | |
| parent | 34996cb91dd72f0b0456d8fd3fef4aaee62232f2 (diff) | |
| download | op-kernel-dev-c8bf4d04f970fafb3430d332533e1cf103f2a018.zip op-kernel-dev-c8bf4d04f970fafb3430d332533e1cf103f2a018.tar.gz | |
xfrm_user: verify policy direction at XFRM_MSG_POLEXPIRE handler
Add missing check for policy direction verification. This is
especially important since without this xfrm_user may end up
deleting per-socket policy which is not allowed.
Signed-off-by: Timo Teras <timo.teras@iki.fi>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/xfrm/xfrm_user.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 6106b72..da5ba86 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -1741,6 +1741,10 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh, if (err) return err; + err = verify_policy_dir(p->dir); + if (err) + return err; + if (p->index) xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, 0, &err); else { |
