diff options
| author | Timo Teräs <timo.teras@iki.fi> | 2010-03-31 02:17:04 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2010-04-02 04:41:35 +0200 |
| commit | c8bf4d04f970fafb3430d332533e1cf103f2a018 (patch) | |
| tree | 5d0a7507da01350b64fe182d7906bc0d85166f8b /net/xfrm | |
| parent | xfrm: Remove xfrm_state_genid (diff) | |
| download | linux-c8bf4d04f970fafb3430d332533e1cf103f2a018.tar.xz linux-c8bf4d04f970fafb3430d332533e1cf103f2a018.zip | |
xfrm_user: verify policy direction at XFRM_MSG_POLEXPIRE handler
Add missing check for policy direction verification. This is
especially important since without this xfrm_user may end up
deleting per-socket policy which is not allowed.
Signed-off-by: Timo Teras <timo.teras@iki.fi>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/xfrm')
| -rw-r--r-- | net/xfrm/xfrm_user.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 6106b72826d3..da5ba86181de 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -1741,6 +1741,10 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh, if (err) return err; + err = verify_policy_dir(p->dir); + if (err) + return err; + if (p->index) xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, 0, &err); else { |