aboutsummaryrefslogtreecommitdiffstats
path: root/net/key
diff options
context:
space:
mode:
authorHerbert Xu <herbert@gondor.apana.org.au>2007-12-20 02:44:29 -0500
committerDavid S. Miller <davem@davemloft.net>2007-12-20 02:44:29 -0500
commitf398035f2dec0a6150833b0bc105057953594edb (patch)
tree861e4cffa93b61d1469df346267fa068f9fdf283 /net/key
parente0260feddf8a68301c75cdfff9ec251d5851b006 (diff)
[IPSEC]: Avoid undefined shift operation when testing algorithm ID
The aalgos/ealgos fields are only 32 bits wide. However, af_key tries to test them with the expression 1 << id where id can be as large as 253. This produces different behaviour on different architectures. The following patch explicitly checks whether ID is greater than 31 and fails the check if that's the case. We cannot easily extend the mask to be longer than 32 bits due to exposure to user-space. Besides, this whole interface is obsolete anyway in favour of the xfrm_user interface which doesn't use this bit mask in templates (well not within the kernel anyway). Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/key')
-rw-r--r--net/key/af_key.c14
1 files changed, 12 insertions, 2 deletions
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 878039b9557d..26d5e63c4cc5 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2784,12 +2784,22 @@ static struct sadb_msg *pfkey_get_base_msg(struct sk_buff *skb, int *errp)
2784 2784
2785static inline int aalg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d) 2785static inline int aalg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d)
2786{ 2786{
2787 return t->aalgos & (1 << d->desc.sadb_alg_id); 2787 unsigned int id = d->desc.sadb_alg_id;
2788
2789 if (id >= sizeof(t->aalgos) * 8)
2790 return 0;
2791
2792 return (t->aalgos >> id) & 1;
2788} 2793}
2789 2794
2790static inline int ealg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d) 2795static inline int ealg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d)
2791{ 2796{
2792 return t->ealgos & (1 << d->desc.sadb_alg_id); 2797 unsigned int id = d->desc.sadb_alg_id;
2798
2799 if (id >= sizeof(t->ealgos) * 8)
2800 return 0;
2801
2802 return (t->ealgos >> id) & 1;
2793} 2803}
2794 2804
2795static int count_ah_combs(struct xfrm_tmpl *t) 2805static int count_ah_combs(struct xfrm_tmpl *t)