Re: [PATCH v2] xfrm: policy: Fix possible user after free in __xfrm_policy_unlink

2019-02-27 Thread YueHaibing
On 2019/2/28 14:41, Herbert Xu wrote: > On Thu, Feb 28, 2019 at 02:38:01PM +0800, Yue Haibing wrote: >> >> diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c >> index a131f9f..aaa45c9 100644 >> --- a/net/xfrm/xfrm_user.c >> +++ b/net/xfrm/xfrm_user.c >> @@ -1424,7 +1424,8 @@ static int veri

Re: [PATCH v2] xfrm: policy: Fix possible user after free in __xfrm_policy_unlink

2019-02-27 Thread Herbert Xu
On Thu, Feb 28, 2019 at 02:38:01PM +0800, Yue Haibing wrote: > > diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c > index a131f9f..aaa45c9 100644 > --- a/net/xfrm/xfrm_user.c > +++ b/net/xfrm/xfrm_user.c > @@ -1424,7 +1424,8 @@ static int verify_newpolicy_info(struct > xfrm_userpolicy_info

[PATCH v2] xfrm: policy: Fix possible user after free in __xfrm_policy_unlink

2019-02-27 Thread Yue Haibing
From: YueHaibing UBSAN report this: UBSAN: Undefined behaviour in net/xfrm/xfrm_policy.c:1289:24 index 6 is out of range for type 'unsigned int [6]' CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.4.162-514.55.6.9.x86_64+ #13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu