tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
fork atom

xfrm: wrong hash value for temporary SA

When kernel inserts a temporary SA for IKE, it uses the wrong hash
value for dst list. Two hash values were calcultated before: one with
source address and one with a wildcard source address.

Bug hinted by Junwei Zhang <junwei.zhang@6wind.com>
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by

Nicolas Dichtel and committed by
David S. Miller 6a783c90 8f955d7f

+3 -3
+3 -3
net/xfrm/xfrm_state.c
··· 794 794 { 795 795 static xfrm_address_t saddr_wildcard = { }; 796 796 struct net *net = xp_net(pol); 797 - unsigned int h; 797 + unsigned int h, h_wildcard; 798 798 struct hlist_node *entry; 799 799 struct xfrm_state *x, *x0, *to_put; 800 800 int acquire_in_progress = 0; ··· 819 819 if (best) 820 820 goto found; 821 821 822 - h = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, family); 823 - hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) { 822 + h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, family); 823 + hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h_wildcard, bydst) { 824 824 if (x->props.family == family && 825 825 x->props.reqid == tmpl->reqid && 826 826 !(x->props.flags & XFRM_STATE_WILDRECV) &&