On Fri, 29 Sep 2017 13:41:05 +0200 (CEST) Michal Kubecek <mkube...@suse.cz> wrote:
> When SA is added manually using "ip xfrm state add", xfrm_state_modify() > uses alg_key_len field of struct xfrm_algo for the length of key passed to > kernel in the netlink message. However alg_key_len is bit length of the key > while we need byte length here. This is usually harmless as kernel ignores > the excess data but when the bit length of the key exceeds 512 > (XFRM_ALGO_KEY_BUF_SIZE), it can result in buffer overflow. > > We can simply divide by 8 here as the only place setting alg_key_len is in > xfrm_algo_parse() where it is always set to a multiple of 8 (and there are > already multiple places using "algo->alg_key_len / 8"). > > Signed-off-by: Michal Kubecek <mkube...@suse.cz> This looks correct applied.
