From: Timo Teräs Date: Thu, 24 Jun 2010 21:35:00 +0000 (-0700) Subject: xfrm: check bundle policy existance before dereferencing it X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=b1312c89f0016f778cac4f1536f1434e132f8713;p=GitHub%2FLineageOS%2Fandroid_kernel_samsung_universal7580.git xfrm: check bundle policy existance before dereferencing it Fix the bundle validation code to not assume having a valid policy. When we have multiple transformations for a xfrm policy, the bundle instance will be a chain of bundles with only the first one having the policy reference. When policy_genid is bumped it will expire the first bundle in the chain which is equivalent of expiring the whole chain. Reported-bisected-and-tested-by: Justin P. Mattock Signed-off-by: Timo Teräs Signed-off-by: David S. Miller --- diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 4bf27d90133..af1c173be4a 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -2300,7 +2300,8 @@ int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *first, return 0; if (xdst->xfrm_genid != dst->xfrm->genid) return 0; - if (xdst->policy_genid != atomic_read(&xdst->pols[0]->genid)) + if (xdst->num_pols > 0 && + xdst->policy_genid != atomic_read(&xdst->pols[0]->genid)) return 0; if (strict && fl &&