summaryrefslogtreecommitdiffstats
path: root/net/xfrm
diff options
context:
space:
mode:
authorTimo Teräs <timo.teras@iki.fi>2010-03-31 00:17:04 +0000
committerDavid S. Miller <davem@davemloft.net>2010-04-01 19:41:35 -0700
commitc8bf4d04f970fafb3430d332533e1cf103f2a018 (patch)
tree5d0a7507da01350b64fe182d7906bc0d85166f8b /net/xfrm
parent34996cb91dd72f0b0456d8fd3fef4aaee62232f2 (diff)
downloadlinux-c8bf4d04f970fafb3430d332533e1cf103f2a018.tar.gz
linux-c8bf4d04f970fafb3430d332533e1cf103f2a018.tar.bz2
linux-c8bf4d04f970fafb3430d332533e1cf103f2a018.zip
xfrm_user: verify policy direction at XFRM_MSG_POLEXPIRE handler
Add missing check for policy direction verification. This is especially important since without this xfrm_user may end up deleting per-socket policy which is not allowed. Signed-off-by: Timo Teras <timo.teras@iki.fi> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/xfrm')
-rw-r--r--net/xfrm/xfrm_user.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 6106b72826d3..da5ba86181de 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1741,6 +1741,10 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
if (err)
return err;
+ err = verify_policy_dir(p->dir);
+ if (err)
+ return err;
+
if (p->index)
xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, 0, &err);
else {