Commit 6ed69184 authored by Myungho Jung's avatar Myungho Jung Committed by Steffen Klassert
Browse files

xfrm: Reset secpath in xfrm failure 



In esp4_gro_receive() and esp6_gro_receive(), secpath can be allocated
without adding xfrm state to xvec. Then, sp->xvec[sp->len - 1] would
fail and result in dereferencing invalid pointer in esp4_gso_segment()
and esp6_gso_segment(). Reset secpath if xfrm function returns error.

Fixes: 7785bba2 ("esp: Add a software GRO codepath")
Reported-by: default avatar <syzbot+b69368fd933c6c592f4c@syzkaller.appspotmail.com>
Signed-off-by: default avatarMyungho Jung <mhjungk@gmail.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent b805d78d

net/ipv4/esp4_offload.c

+5 −3
Original line number Diff line number Diff line
@@ -52,13 +52,13 @@ static struct sk_buff *esp4_gro_receive(struct list_head *head, 
			goto out;



		if (sp->len == XFRM_MAX_DEPTH)

			goto out;

			goto out_reset;



		x = xfrm_state_lookup(dev_net(skb->dev), skb->mark,

				      (xfrm_address_t *)&ip_hdr(skb)->daddr,

				      spi, IPPROTO_ESP, AF_INET);

		if (!x)

			goto out;

			goto out_reset;



		sp->xvec[sp->len++] = x;

		sp->olen++;
@@ -66,7 +66,7 @@ static struct sk_buff *esp4_gro_receive(struct list_head *head, 
		xo = xfrm_offload(skb);

		if (!xo) {

			xfrm_state_put(x);

			goto out;

			goto out_reset;

		}

	}
@@ -82,6 +82,8 @@ static struct sk_buff *esp4_gro_receive(struct list_head *head, 
	xfrm_input(skb, IPPROTO_ESP, spi, -2);



	return ERR_PTR(-EINPROGRESS);

out_reset:

	secpath_reset(skb);

out:

	skb_push(skb, offset);

	NAPI_GRO_CB(skb)->same_flow = 0;

net/ipv6/esp6_offload.c

+5 −3
Original line number Diff line number Diff line
@@ -74,13 +74,13 @@ static struct sk_buff *esp6_gro_receive(struct list_head *head, 
			goto out;



		if (sp->len == XFRM_MAX_DEPTH)

			goto out;

			goto out_reset;



		x = xfrm_state_lookup(dev_net(skb->dev), skb->mark,

				      (xfrm_address_t *)&ipv6_hdr(skb)->daddr,

				      spi, IPPROTO_ESP, AF_INET6);

		if (!x)

			goto out;

			goto out_reset;



		sp->xvec[sp->len++] = x;

		sp->olen++;
@@ -88,7 +88,7 @@ static struct sk_buff *esp6_gro_receive(struct list_head *head, 
		xo = xfrm_offload(skb);

		if (!xo) {

			xfrm_state_put(x);

			goto out;

			goto out_reset;

		}

	}
@@ -109,6 +109,8 @@ static struct sk_buff *esp6_gro_receive(struct list_head *head, 
	xfrm_input(skb, IPPROTO_ESP, spi, -2);



	return ERR_PTR(-EINPROGRESS);

out_reset:

	secpath_reset(skb);

out:

	skb_push(skb, offset);

	NAPI_GRO_CB(skb)->same_flow = 0;

CRA Git | Maintained and supported by SUSTech CRA and CCSE