]> git.baikalelectronics.ru Git - kernel.git/commit
xfrm: check id proto in validate_tmpl()
authorCong Wang <xiyou.wangcong@gmail.com>
Mon, 27 Nov 2017 19:15:16 +0000 (11:15 -0800)
committerSteffen Klassert <steffen.klassert@secunet.com>
Wed, 29 Nov 2017 07:55:29 +0000 (08:55 +0100)
commit37ca5c6fdbe2dc3fc1d629d140961b15340102d1
treed5fcf6bafbc4a4e9cf0f307b20bdc5040c12c414
parentd64d177d0131d77548ba09d341883be432822250
xfrm: check id proto in validate_tmpl()

syzbot reported a kernel warning in xfrm_state_fini(), which
indicates that we have entries left in the list
net->xfrm.state_all whose proto is zero. And
xfrm_id_proto_match() doesn't consider them as a match with
IPSEC_PROTO_ANY in this case.

Proto with value 0 is probably not a valid value, at least
verify_newsa_info() doesn't consider it valid either.

This patch fixes it by checking the proto value in
validate_tmpl() and rejecting invalid ones, like what iproute2
does in xfrm_xfrmproto_getbyname().

Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
net/xfrm/xfrm_user.c