Re: [PATCH v2] xfrm: policy: Fix possible user after free in __xfrm_policy_unlink

[Herbert Xu]

On Thu, Feb 28, 2019 at 02:38:01PM +0800, Yue Haibing wrote:
>
> diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
> index a131f9f..aaa45c9 100644
> --- a/net/xfrm/xfrm_user.c
> +++ b/net/xfrm/xfrm_user.c
> @@ -1424,7 +1424,8 @@ static int verify_newpolicy_info(struct 
> xfrm_userpolicy_info *p)
>       ret = verify_policy_dir(p->dir);
>       if (ret)
>               return ret;
> -     if (p->index && ((p->index & XFRM_POLICY_MAX) != p->dir))
> +     if (p->index && (((p->index & XFRM_POLICY_MAX) != p->dir) ||
> +                      (xfrm_policy_id2dir(p->index) >= XFRM_POLICY_MAX)))

Please just check 

        xfrm_policy_id2dir(p->index) != p->dir

Thanks,
-- 
Email: Herbert Xu <herb...@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt