From: Steffen Klassert <steffen.klassert@secunet.com>
Date: Mon, 9 Sep 2013 07:39:01 +0000 (+0200)
Subject: xfrm: Fix replay size checking on async events
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=4479ff76c43607b680f9349128d8493228b49dce;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git

xfrm: Fix replay size checking on async events

We pass the wrong netlink attribute to xfrm_replay_verify_len().
It should be XFRMA_REPLAY_ESN_VAL and not XFRMA_REPLAY_VAL as
we currently doing. This causes memory corruptions if the
replay esn attribute has incorrect length. Fix this by passing
the right attribute to xfrm_replay_verify_len().

Reported-by: Michael Rossberg <michael.rossberg@tu-ilmenau.de>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 3f565e495ac6..4b26ceedff26 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1856,7 +1856,7 @@ static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
 	if (x->km.state != XFRM_STATE_VALID)
 		goto out;
 
-	err = xfrm_replay_verify_len(x->replay_esn, rp);
+	err = xfrm_replay_verify_len(x->replay_esn, re);
 	if (err)
 		goto out;