aboutsummaryrefslogtreecommitdiffstats
path: root/net/key/af_key.c
diff options
context:
space:
mode:
Diffstat (limited to 'net/key/af_key.c')
-rw-r--r--net/key/af_key.c11
1 files changed, 8 insertions, 3 deletions
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 50d0a31c3ba6..bbf0f69181ba 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2154,6 +2154,7 @@ out:
2154 2154
2155static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs) 2155static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
2156{ 2156{
2157 unsigned int dir;
2157 int err; 2158 int err;
2158 struct sadb_x_policy *pol; 2159 struct sadb_x_policy *pol;
2159 struct xfrm_policy *xp; 2160 struct xfrm_policy *xp;
@@ -2162,7 +2163,11 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
2162 if ((pol = ext_hdrs[SADB_X_EXT_POLICY-1]) == NULL) 2163 if ((pol = ext_hdrs[SADB_X_EXT_POLICY-1]) == NULL)
2163 return -EINVAL; 2164 return -EINVAL;
2164 2165
2165 xp = xfrm_policy_byid(0, pol->sadb_x_policy_id, 2166 dir = xfrm_policy_id2dir(pol->sadb_x_policy_id);
2167 if (dir >= XFRM_POLICY_MAX)
2168 return -EINVAL;
2169
2170 xp = xfrm_policy_byid(dir, pol->sadb_x_policy_id,
2166 hdr->sadb_msg_type == SADB_X_SPDDELETE2); 2171 hdr->sadb_msg_type == SADB_X_SPDDELETE2);
2167 if (xp == NULL) 2172 if (xp == NULL)
2168 return -ENOENT; 2173 return -ENOENT;
@@ -2174,9 +2179,9 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
2174 if (hdr->sadb_msg_type == SADB_X_SPDDELETE2) { 2179 if (hdr->sadb_msg_type == SADB_X_SPDDELETE2) {
2175 c.data.byid = 1; 2180 c.data.byid = 1;
2176 c.event = XFRM_MSG_DELPOLICY; 2181 c.event = XFRM_MSG_DELPOLICY;
2177 km_policy_notify(xp, pol->sadb_x_policy_dir-1, &c); 2182 km_policy_notify(xp, dir, &c);
2178 } else { 2183 } else {
2179 err = key_pol_get_resp(sk, xp, hdr, pol->sadb_x_policy_dir-1); 2184 err = key_pol_get_resp(sk, xp, hdr, dir);
2180 } 2185 }
2181 2186
2182 xfrm_pol_put(xp); 2187 xfrm_pol_put(xp);