lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Thu, 12 May 2022 09:44:57 +0200
From:   Antony Antony <>
To:     Steffen Klassert <>
CC:     <>, Tobias Brunner <>
Subject: [PATCH RFC ipsec] xfrm: fix panic in xfrm_delete from userspace on
 ARM 32

A kernel panic was reported on ARM 32 architecture.
In spite of initialization, x = kmem_cache_zalloc(xfrm_state_cache, GFP_ATOMIC),
x->mapping_maxage appears to be nozero and cause kernel panic in

(__xfrm_state_delete) from [<c091ad58>] (xfrm_state_delete+0x24/0x44)
(xfrm_state_delete) from [<bf4c31e4>] (xfrm_del_sa+0x94/0xe4 [xfrm_user])
(xfrm_del_sa [xfrm_user]) from [<bf4c2180>] (xfrm_user_rcv_msg+0xe0/0x1d0 [xfrm_user])
(xfrm_user_rcv_msg [xfrm_user]) from [<c0878da4>] (netlink_rcv_skb+0xd8/0x148)
(netlink_rcv_skb) from [<bf4c1724>] (xfrm_netlink_rcv+0x2c/0x48 [xfrm_user])
(xfrm_netlink_rcv [xfrm_user]) from [<c0878408>] (netlink_unicast+0x208/0x31c)
(netlink_unicast) from [<c0878710>] (netlink_sendmsg+0x1f4/0x468)
(netlink_sendmsg) from [<c07e1408>] (__sys_sendto+0xd4/0x13c)

Even if x->mapping_maxage is non zero I can't explain the cause of panic.
However, roth-m reports setting  x->mapping_maxage = 0 fix the panic!

I am still not sure of the cause. So I proposing the fix as an RFC.
Anyone has experience with nondeterministic kmem_cache_zalloc() on 32 bit ARM hardware?
Note other initializations in xfrm_state_alloc() x->replay_maxage = 0. I
wonder why those were added when there is kmem_cache_zalloc call above.

The bug report mentioned OpenWRT tool chain and OpenWRT kernel.

Fixes: 4e484b3e969b ("xfrm: rate limit SA mapping change message to user space")
Suggested-by: Tobias Brunner <>
Signed-off-by: Antony Antony <>
 net/xfrm/xfrm_state.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index b749935152ba..1724a9bd232e 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -654,6 +654,9 @@ struct xfrm_state *xfrm_state_alloc(struct net *net)
 		x->lft.hard_packet_limit = XFRM_INF;
 		x->replay_maxage = 0;
 		x->replay_maxdiff = 0;
+		x->mapping_maxage = 0;
+		x->new_mapping = 0;
+		x->new_mapping_sport = 0;
 	return x;

Powered by blists - more mailing lists