* [PATCH] xfrm_user: propagate sec ctx allocation errors
@ 2016-09-08 16:09 Mathias Krause
2016-09-09 8:34 ` Steffen Klassert
0 siblings, 1 reply; 2+ messages in thread
From: Mathias Krause @ 2016-09-08 16:09 UTC (permalink / raw)
To: Steffen Klassert
Cc: David S. Miller, Herbert Xu, netdev, Mathias Krause, Thomas Graf
When we fail to attach the security context in xfrm_state_construct()
we'll return 0 as error value which, in turn, will wrongly claim success
to userland when, in fact, we won't be adding / updating the XFRM state.
This is a regression introduced by commit fd21150a0fe1 ("[XFRM] netlink:
Inline attach_encap_tmpl(), attach_sec_ctx(), and attach_one_addr()").
Fix it by propagating the error returned by security_xfrm_state_alloc()
in this case.
Fixes: fd21150a0fe1 ("[XFRM] netlink: Inline attach_encap_tmpl()...")
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Thomas Graf <tgraf@suug.ch>
---
net/xfrm/xfrm_user.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index d516845e16e3..b08440a8f123 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -581,9 +581,12 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
if (err)
goto error;
- if (attrs[XFRMA_SEC_CTX] &&
- security_xfrm_state_alloc(x, nla_data(attrs[XFRMA_SEC_CTX])))
- goto error;
+ if (attrs[XFRMA_SEC_CTX]) {
+ err = security_xfrm_state_alloc(x,
+ nla_data(attrs[XFRMA_SEC_CTX]));
+ if (err)
+ goto error;
+ }
if ((err = xfrm_alloc_replay_state_esn(&x->replay_esn, &x->preplay_esn,
attrs[XFRMA_REPLAY_ESN_VAL])))
--
1.7.10.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] xfrm_user: propagate sec ctx allocation errors
2016-09-08 16:09 [PATCH] xfrm_user: propagate sec ctx allocation errors Mathias Krause
@ 2016-09-09 8:34 ` Steffen Klassert
0 siblings, 0 replies; 2+ messages in thread
From: Steffen Klassert @ 2016-09-09 8:34 UTC (permalink / raw)
To: Mathias Krause; +Cc: David S. Miller, Herbert Xu, netdev, Thomas Graf
On Thu, Sep 08, 2016 at 06:09:57PM +0200, Mathias Krause wrote:
> When we fail to attach the security context in xfrm_state_construct()
> we'll return 0 as error value which, in turn, will wrongly claim success
> to userland when, in fact, we won't be adding / updating the XFRM state.
>
> This is a regression introduced by commit fd21150a0fe1 ("[XFRM] netlink:
> Inline attach_encap_tmpl(), attach_sec_ctx(), and attach_one_addr()").
>
> Fix it by propagating the error returned by security_xfrm_state_alloc()
> in this case.
>
> Fixes: fd21150a0fe1 ("[XFRM] netlink: Inline attach_encap_tmpl()...")
> Signed-off-by: Mathias Krause <minipli@googlemail.com>
Applied to the ipsec tree, thanks Mathias!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-09-09 8:35 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-09-08 16:09 [PATCH] xfrm_user: propagate sec ctx allocation errors Mathias Krause
2016-09-09 8:34 ` Steffen Klassert
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).