summaryrefslogtreecommitdiffstats
path: root/net/xfrm
diff options
context:
space:
mode:
authorSteffen Klassert <steffen.klassert@secunet.com>2014-02-19 13:33:23 +0100
committerSteffen Klassert <steffen.klassert@secunet.com>2014-02-20 14:29:58 +0100
commit35ea790d7883dd660208f78eae50ebfd6b8bd14a (patch)
tree29fd34fd5df068375acbd51de352e0955de633b6 /net/xfrm
parent876fc03aaa4d8cc81331119d80d3e9bfbf1164e8 (diff)
downloadlinux-35ea790d7883dd660208f78eae50ebfd6b8bd14a.tar.gz
linux-35ea790d7883dd660208f78eae50ebfd6b8bd14a.tar.bz2
linux-35ea790d7883dd660208f78eae50ebfd6b8bd14a.zip
xfrm: Fix NULL pointer dereference on sub policy usage
xfrm_state_sort() takes the unsorted states from the src array and stores them into the dst array. We try to get the namespace from the dst array which is empty at this time, so take the namespace from the src array instead. Fixes: 283bc9f35bbbc ("xfrm: Namespacify xfrm state/policy locks") Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to 'net/xfrm')
-rw-r--r--net/xfrm/xfrm_state.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index a26b7aa79475..97d117b80ba4 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1451,7 +1451,7 @@ xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
{
int err = 0;
struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
- struct net *net = xs_net(*dst);
+ struct net *net = xs_net(*src);
if (!afinfo)
return -EAFNOSUPPORT;