LIMIT_NETDEBUG( printk(KERN_WARNING "ipsec esp packet is garbage padlen=%d, elen=%d\n", padlen+2, elen)); 
LIMIT_NETDEBUG(KERN_WARNING "ipsec esp packet is garbage padlen=%d, elen=%d\n", padlen+2, elen); 
static int esp6_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struct sk_buff *skb){	struct ipv6hdr *iph;	struct ipv6_esp_hdr *esph;	struct esp_data *esp = x->data;	struct sk_buff *trailer;	int blksize = crypto_tfm_alg_blocksize(esp->conf.tfm);	int alen = esp->auth.icv_trunc_len;	int elen = skb->len - sizeof(struct ipv6_esp_hdr) - esp->conf.ivlen - alen;	int hdr_len = skb->h.raw - skb->nh.raw;	int nfrags;	unsigned char *tmp_hdr = NULL;	int ret = 0;	if (!pskb_may_pull(skb, sizeof(struct ipv6_esp_hdr))) {		ret = -EINVAL;		goto out_nofree;	}	if (elen <= 0 || (elen & (blksize-1))) {		ret = -EINVAL;		goto out_nofree;	}	tmp_hdr = kmalloc(hdr_len, GFP_ATOMIC);	if (!tmp_hdr) {		ret = -ENOMEM;		goto out_nofree;	}	memcpy(tmp_hdr, skb->nh.raw, hdr_len);	/* If integrity check is required, do this. */        if (esp->auth.icv_full_len) {		u8 sum[esp->auth.icv_full_len];		u8 sum1[alen];		esp->auth.icv(esp, skb, 0, skb->len-alen, sum);		if (skb_copy_bits(skb, skb->len-alen, sum1, alen))			BUG();		if (unlikely(memcmp(sum, sum1, alen))) {			x->stats.integrity_failed++;			ret = -EINVAL;			goto out;		}	}	if ((nfrags = skb_cow_data(skb, 0, &trailer)) < 0) {		ret = -EINVAL;		goto out;	}	skb->ip_summed = CHECKSUM_NONE;	esph = (struct ipv6_esp_hdr*)skb->data;	iph = skb->nh.ipv6h;	/* Get ivec. This can be wrong, check against another impls. */	if (esp->conf.ivlen)		crypto_cipher_set_iv(esp->conf.tfm, esph->enc_data, crypto_tfm_alg_ivsize(esp->conf.tfm));        {		u8 nexthdr[2];		struct scatterlist *sg = &esp->sgbuf[0];		u8 padlen;		if (unlikely(nfrags > ESP_NUM_FAST_SG)) {			sg = kmalloc(sizeof(struct scatterlist)*nfrags, GFP_ATOMIC);			if (!sg) {				ret = -ENOMEM;				goto out;			}		}		skb_to_sgvec(skb, sg, sizeof(struct ipv6_esp_hdr) + esp->conf.ivlen, elen);		crypto_cipher_decrypt(esp->conf.tfm, sg, sg, elen);		if (unlikely(sg != &esp->sgbuf[0]))			kfree(sg);		if (skb_copy_bits(skb, skb->len-alen-2, nexthdr, 2))			BUG();		padlen = nexthdr[0];		if (padlen+2 >= elen) {			LIMIT_NETDEBUG(				printk(KERN_WARNING "ipsec esp packet is garbage padlen=%d, elen=%d\n", padlen+2, elen));			ret = -EINVAL;			goto out;		}		/* ... check padding bits here. Silly. :-) */ 		pskb_trim(skb, skb->len - alen - padlen - 2);		skb->h.raw = skb_pull(skb, sizeof(struct ipv6_esp_hdr) + esp->conf.ivlen);		skb->nh.raw += sizeof(struct ipv6_esp_hdr) + esp->conf.ivlen;		memcpy(skb->nh.raw, tmp_hdr, hdr_len);		skb->nh.ipv6h->payload_len = htons(skb->len - sizeof(struct ipv6hdr));		ret = nexthdr[1];	}out:	kfree(tmp_hdr);out_nofree:	return ret;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/64ce207306debd7157f47282be94770407bec01c/esp6.c/buggy/net/ipv6/esp6.c