Re: [PATCH v2] xfrm: policy: Fix possible user after free in __xfrm_policy_unlink

[YueHaibing]

On 2019/2/28 14:41, Herbert Xu wrote:
> On Thu, Feb 28, 2019 at 02:38:01PM +0800, Yue Haibing wrote:
>>
>> diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
>> index a131f9f..aaa45c9 100644
>> --- a/net/xfrm/xfrm_user.c
>> +++ b/net/xfrm/xfrm_user.c
>> @@ -1424,7 +1424,8 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
>>  	ret = verify_policy_dir(p->dir);
>>  	if (ret)
>>  		return ret;
>> -	if (p->index && ((p->index & XFRM_POLICY_MAX) != p->dir))
>> +	if (p->index && (((p->index & XFRM_POLICY_MAX) != p->dir) ||
>> +			 (xfrm_policy_id2dir(p->index) >= XFRM_POLICY_MAX)))
> 
> Please just check 
> 
> 	xfrm_policy_id2dir(p->index) != p->dir


Oh, it indeed can be merged, Thanks!

> 
> Thanks,
>