netdev - Re: [PATCH RFC ipsec] xfrm: Fix crash when the hold queue is used.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20200724052721.GT20687@gauss3.secunet.de>
Date:   Fri, 24 Jul 2020 07:27:21 +0200
From:   Steffen Klassert <steffen.klassert@...unet.com>
To:     <netdev@...r.kernel.org>
Subject: Re: [PATCH RFC ipsec] xfrm: Fix crash when the hold queue is used.

On Fri, Jul 17, 2020 at 10:34:27AM +0200, Steffen Klassert wrote:
> The commits "xfrm: Move dst->path into struct xfrm_dst"
> and "net: Create and use new helper xfrm_dst_child()."
> changed xfrm bundle handling under the assumption
> that xdst->path and dst->child are not a NULL pointer
> only if dst->xfrm is not a NULL pointer. That is true
> with one exception. If the xfrm hold queue is used
> to wait until a SA is installed by the key manager,
> we create a dummy bundle without a valid dst->xfrm
> pointer. The current xfrm bundle handling crashes
> in that case. Fix this by extending the NULL check
> of dst->xfrm with a test of the DST_XFRM_QUEUE flag.
> 
> Fixes: 0f6c480f23f4 ("xfrm: Move dst->path into struct xfrm_dst")
> Fixes: b92cf4aab8e6 ("net: Create and use new helper xfrm_dst_child().")
> Signed-off-by: Steffen Klassert <steffen.klassert@...unet.com>

Now applied to the ipsec tree.