From 2a5cc53ea19ee8c8364a291745f73832673d2c04 Mon Sep 17 00:00:00 2001 From: Steffen Klassert Date: Thu, 31 Aug 2017 10:37:00 +0200 Subject: [PATCH] BACKPORT: xfrm: Fix return value check of copy_sec_ctx. A recent commit added an output_mark. When copying this output_mark, the return value of copy_sec_ctx is overwitten without a check. Fix this by copying the output_mark before the security context. Fixes: 077fbac405bf ("net: xfrm: support setting an output mark.") Signed-off-by: Steffen Klassert (cherry picked from commit 8598112d04af21cf6c895670e72dcb8a9f58e74f) Change-Id: I25e9ac6cf79dc8d0ee599bbd23e9d5b5f34a4284 --- net/xfrm/xfrm_user.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 2cade0276299..b09febe8782e 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -872,13 +872,13 @@ static int copy_to_user_state_extra(struct xfrm_state *x, &x->replay); if (ret) goto out; - if (x->security) - ret = copy_sec_ctx(x->security, skb); if (x->props.output_mark) { ret = nla_put_u32(skb, XFRMA_OUTPUT_MARK, x->props.output_mark); if (ret) goto out; } + if (x->security) + ret = copy_sec_ctx(x->security, skb); out: return ret; }