lkml.org 
[lkml]   [2018]   [Feb]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 016/159] xfrm: check id proto in validate_tmpl()
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Cong Wang <xiyou.wangcong@gmail.com>

    commit 6a53b7593233ab9e4f96873ebacc0f653a55c3e1 upstream.

    syzbot reported a kernel warning in xfrm_state_fini(), which
    indicates that we have entries left in the list
    net->xfrm.state_all whose proto is zero. And
    xfrm_id_proto_match() doesn't consider them as a match with
    IPSEC_PROTO_ANY in this case.

    Proto with value 0 is probably not a valid value, at least
    verify_newsa_info() doesn't consider it valid either.

    This patch fixes it by checking the proto value in
    validate_tmpl() and rejecting invalid ones, like what iproute2
    does in xfrm_xfrmproto_getbyname().

    Reported-by: syzbot <syzkaller@googlegroups.com>
    Cc: Steffen Klassert <steffen.klassert@secunet.com>
    Cc: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
    Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/xfrm/xfrm_user.c | 15 +++++++++++++++
    1 file changed, 15 insertions(+)

    --- a/net/xfrm/xfrm_user.c
    +++ b/net/xfrm/xfrm_user.c
    @@ -1443,6 +1443,21 @@ static int validate_tmpl(int nr, struct
    default:
    return -EINVAL;
    }
    +
    + switch (ut[i].id.proto) {
    + case IPPROTO_AH:
    + case IPPROTO_ESP:
    + case IPPROTO_COMP:
    +#if IS_ENABLED(CONFIG_IPV6)
    + case IPPROTO_ROUTING:
    + case IPPROTO_DSTOPTS:
    +#endif
    + case IPSEC_PROTO_ANY:
    + break;
    + default:
    + return -EINVAL;
    + }
    +
    }

    return 0;

    \
     
     \ /
      Last update: 2018-02-23 20:40    [W:3.264 / U:0.092 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site