1 files changed, 15 insertions, 0 deletions

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 4791aa8b8185..df7ca2dabc48 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -151,10 +151,16 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
         err = -EINVAL;
         switch (p->family) {
         case AF_INET:
+                if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
+                        goto out;
+
                 break;
 
         case AF_INET6:
 #if IS_ENABLED(CONFIG_IPV6)
+                if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128)
+                        goto out;
+
                 break;
 #else
                 err = -EAFNOSUPPORT;
@@ -1396,10 +1402,16 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
 
         switch (p->sel.family) {
         case AF_INET:
+                if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
+                        return -EINVAL;
+
                 break;
 
         case AF_INET6:
 #if IS_ENABLED(CONFIG_IPV6)
+                if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128)
+                        return -EINVAL;
+
                 break;
 #else
                 return  -EAFNOSUPPORT;
@@ -1480,6 +1492,9 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
                     (ut[i].family != prev_family))
                         return -EINVAL;
 
+                if (ut[i].mode >= XFRM_MODE_MAX)
+                        return -EINVAL;
+
                 prev_family = ut[i].family;
 
                 switch (ut[i].family) {