• Herbert Xu's avatar
    [IPSEC]: Check validity of direction in xfrm_policy_byid · b5505c6e
    Herbert Xu authored
    The function xfrm_policy_byid takes a dir argument but finds the policy
    using the index instead.  We only use the dir argument to update the
    policy count for that direction.  Since the user can supply any value
    for dir, this can corrupt our policy count.
    
    I know this is the problem because a few days ago I was deleting
    policies by hand using indicies and accidentally typed in the wrong
    direction.  It still deleted the policy and at the time I thought
    that was cool.  In retrospect it isn't such a good idea :)
    
    I decided against letting it delete the policy anyway just in case
    we ever remove the connection between indicies and direction.
    Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    b5505c6e
xfrm_policy.c 59.2 KB