From: Mathias Krause <minipli@googlemail.com>
Date: Thu, 13 Sep 2012 11:41:26 +0000 (+0000)
Subject: xfrm_user: return error pointer instead of NULL
X-Git-Tag: v3.6-rc7~10^2~31
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=864745d291b5ba80ea0bd0edcbe67273de368836;p=pandora-kernel.git

xfrm_user: return error pointer instead of NULL

When dump_one_state() returns an error, e.g. because of a too small
buffer to dump the whole xfrm state, xfrm_state_netlink() returns NULL
instead of an error pointer. But its callers expect an error pointer
and therefore continue to operate on a NULL skbuff.

This could lead to a privilege escalation (execution of user code in
kernel context) if the attacker has CAP_NET_ADMIN and is able to map
address 0.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

Reading git-diff-tree failed