Showing error 1894

User: Jiri Slaby
Error type: Invalid Pointer Dereference
Error type description: A pointer which is invalid is being dereferenced
File location: net/key/af_key.c
Line in file: 980
Project: Linux Kernel
Project version: 2.6.28
Tools: Smatch (1.59)
Entered: 2013-09-11 08:47:26 UTC

Source: 

 950                        sizeof(uint64_t);
 951                addr->sadb_address_exttype = SADB_EXT_ADDRESS_PROXY;
 952                addr->sadb_address_proto =
 953                        pfkey_proto_from_xfrm(x->sel.proto);
 954                addr->sadb_address_prefixlen = x->sel.prefixlen_s;
 955                addr->sadb_address_reserved = 0;
 956
 957                pfkey_sockaddr_fill(&x->sel.saddr, x->sel.sport,
 958                                    (struct sockaddr *) (addr + 1),
 959                                    x->props.family);
 960        }
 961
 962        /* auth key */
 963        if (add_keys && auth_key_size) {
 964                key = (struct sadb_key *) skb_put(skb,
 965                                                  sizeof(struct sadb_key)+auth_key_size);
 966                key->sadb_key_len = (sizeof(struct sadb_key) + auth_key_size) /
 967                        sizeof(uint64_t);
 968                key->sadb_key_exttype = SADB_EXT_KEY_AUTH;
 969                key->sadb_key_bits = x->aalg->alg_key_len;
 970                key->sadb_key_reserved = 0;
 971                memcpy(key + 1, x->aalg->alg_key, (x->aalg->alg_key_len+7)/8);
 972        }
 973        /* encrypt key */
 974        if (add_keys && encrypt_key_size) {
 975                key = (struct sadb_key *) skb_put(skb,
 976                                                  sizeof(struct sadb_key)+encrypt_key_size);
 977                key->sadb_key_len = (sizeof(struct sadb_key) +
 978                                     encrypt_key_size) / sizeof(uint64_t);
 979                key->sadb_key_exttype = SADB_EXT_KEY_ENCRYPT;
 980                key->sadb_key_bits = x->ealg->alg_key_len;
 981                key->sadb_key_reserved = 0;
 982                memcpy(key + 1, x->ealg->alg_key,
 983                       (x->ealg->alg_key_len+7)/8);
 984        }
 985
 986        /* sa */
 987        sa2 = (struct sadb_x_sa2 *)  skb_put(skb, sizeof(struct sadb_x_sa2));
 988        sa2->sadb_x_sa2_len = sizeof(struct sadb_x_sa2)/sizeof(uint64_t);
 989        sa2->sadb_x_sa2_exttype = SADB_X_EXT_SA2;
 990        if ((mode = pfkey_mode_from_xfrm(x->props.mode)) < 0) {
Show full sources
↑