netdev - Re: [PATCH net] vti6: fix input path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20160921101943.GJ31137@gauss.secunet.com>
Date:   Wed, 21 Sep 2016 12:19:43 +0200
From:   Steffen Klassert <steffen.klassert@...unet.com>
To:     Nicolas Dichtel <nicolas.dichtel@...nd.com>
CC:     <davem@...emloft.net>, <netdev@...r.kernel.org>,
        Alexey Kodanev <alexey.kodanev@...cle.com>
Subject: Re: [PATCH net] vti6: fix input path

On Mon, Sep 19, 2016 at 04:17:57PM +0200, Nicolas Dichtel wrote:
> Since commit 1625f4529957, vti6 is broken, all input packets are dropped
> (LINUX_MIB_XFRMINNOSTATES is incremented).
> 
> XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 is set by vti6_rcv() before calling
> xfrm6_rcv()/xfrm6_rcv_spi(), thus we cannot set to NULL that value in
> xfrm6_rcv_spi().
> 
> A new function xfrm6_rcv_tnl() that enables to pass a value to
> xfrm6_rcv_spi() is added, so that xfrm6_rcv() is not touched (this function
> is used in several handlers).
> 
> CC: Alexey Kodanev <alexey.kodanev@...cle.com>
> Fixes: 1625f4529957 ("net/xfrm_input: fix possible NULL deref of tunnel.ip6->parms.i_key")
> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@...nd.com>

Applied to the ipsec tree, thanks Nicolas!