summaryrefslogtreecommitdiffstats
path: root/net/xfrm
diff options
context:
space:
mode:
authorMathias Krause <minipli@googlemail.com>2016-09-08 18:09:57 +0200
committerSteffen Klassert <steffen.klassert@secunet.com>2016-09-09 09:02:08 +0200
commit2f30ea5090cbc57ea573cdc66421264b3de3fb0a (patch)
tree7602a1be11bed9830f738558048fd87b3aca0e4f /net/xfrm
parent2c2c8e33e4aa6e46f19ef7bba8e559759a74a4db (diff)
downloadlinux-stable-2f30ea5090cbc57ea573cdc66421264b3de3fb0a.tar.gz
linux-stable-2f30ea5090cbc57ea573cdc66421264b3de3fb0a.tar.bz2
linux-stable-2f30ea5090cbc57ea573cdc66421264b3de3fb0a.zip
xfrm_user: propagate sec ctx allocation errors
When we fail to attach the security context in xfrm_state_construct() we'll return 0 as error value which, in turn, will wrongly claim success to userland when, in fact, we won't be adding / updating the XFRM state. This is a regression introduced by commit fd21150a0fe1 ("[XFRM] netlink: Inline attach_encap_tmpl(), attach_sec_ctx(), and attach_one_addr()"). Fix it by propagating the error returned by security_xfrm_state_alloc() in this case. Fixes: fd21150a0fe1 ("[XFRM] netlink: Inline attach_encap_tmpl()...") Signed-off-by: Mathias Krause <minipli@googlemail.com> Cc: Thomas Graf <tgraf@suug.ch> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to 'net/xfrm')
-rw-r--r--net/xfrm/xfrm_user.c9
1 files changed, 6 insertions, 3 deletions
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index cb65d916a345..08892091cfe3 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -581,9 +581,12 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
if (err)
goto error;
- if (attrs[XFRMA_SEC_CTX] &&
- security_xfrm_state_alloc(x, nla_data(attrs[XFRMA_SEC_CTX])))
- goto error;
+ if (attrs[XFRMA_SEC_CTX]) {
+ err = security_xfrm_state_alloc(x,
+ nla_data(attrs[XFRMA_SEC_CTX]));
+ if (err)
+ goto error;
+ }
if ((err = xfrm_alloc_replay_state_esn(&x->replay_esn, &x->preplay_esn,
attrs[XFRMA_REPLAY_ESN_VAL])))