Re: [PATCH] xfrm: Reset secpath in xfrm failure

2019-03-06 Thread Myungho Jung
On Wed, Mar 06, 2019 at 12:35:43PM +0100, Steffen Klassert wrote: > On Wed, Mar 06, 2019 at 04:33:08PM +0900, Myungho Jung wrote: > > In esp4_gro_receive() and esp6_gro_receive(), secpath can be allocated > > without adding xfrm state to xvec. Then, sp->xvec[sp->len - 1] would > > fail and result i

Re: [PATCH] xfrm: Reset secpath in xfrm failure

2019-03-06 Thread Steffen Klassert
On Wed, Mar 06, 2019 at 04:33:08PM +0900, Myungho Jung wrote: > In esp4_gro_receive() and esp6_gro_receive(), secpath can be allocated > without adding xfrm state to xvec. Then, sp->xvec[sp->len - 1] would > fail and result in dereferencing invalid pointer in esp4_gso_segment() > and esp6_gso_segme

[PATCH] xfrm: Reset secpath in xfrm failure

2019-03-05 Thread Myungho Jung
In esp4_gro_receive() and esp6_gro_receive(), secpath can be allocated without adding xfrm state to xvec. Then, sp->xvec[sp->len - 1] would fail and result in dereferencing invalid pointer in esp4_gso_segment() and esp6_gso_segment(). Reset secpath if xfrm function returns error. Reported-by: syzb