netdev - Re: [Patch net] xfrm: check id proto in validate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20171129121550.m2dyy5ahf66trkqz@gauss3.secunet.de>
Date:   Wed, 29 Nov 2017 13:15:51 +0100
From:   Steffen Klassert <steffen.klassert@...unet.com>
To:     Cong Wang <xiyou.wangcong@...il.com>
CC:     <netdev@...r.kernel.org>, Herbert Xu <herbert@...dor.apana.org.au>
Subject: Re: [Patch net] xfrm: check id proto in validate_tmpl()

On Mon, Nov 27, 2017 at 11:15:16AM -0800, Cong Wang wrote:
> syzbot reported a kernel warning in xfrm_state_fini(), which
> indicates that we have entries left in the list
> net->xfrm.state_all whose proto is zero. And
> xfrm_id_proto_match() doesn't consider them as a match with
> IPSEC_PROTO_ANY in this case.
> 
> Proto with value 0 is probably not a valid value, at least
> verify_newsa_info() doesn't consider it valid either.
> 
> This patch fixes it by checking the proto value in
> validate_tmpl() and rejecting invalid ones, like what iproute2
> does in xfrm_xfrmproto_getbyname().
> 
> Reported-by: syzbot <syzkaller@...glegroups.com>
> Cc: Steffen Klassert <steffen.klassert@...unet.com>
> Cc: Herbert Xu <herbert@...dor.apana.org.au>
> Signed-off-by: Cong Wang <xiyou.wangcong@...il.com>

Patch applied, thanks!