Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Wed, 15 Nov 2017 12:29:19 +0100
From:   Steffen Klassert <steffen.klassert@secunet.com>
To:     Herbert Xu <herbert@gondor.apana.org.au>
CC:     Dmitry Vyukov <dvyukov@google.com>,
        syzbot 
        <bot+413384116f7f7dab7903d54c53fc4af6a4441965@syzkaller.appspotmail.com>,
        David Miller <davem@davemloft.net>,
        LKML <linux-kernel@vger.kernel.org>,
        netdev <netdev@vger.kernel.org>,
        <syzkaller-bugs@googlegroups.com>
Subject: Re: kernel BUG at net/key/af_key.c:LINE!
Message-ID: <20171115112919.GT11292@secunet.com>
References: <001a114a958ce46160055c4c4f66@google.com>
 <CACT4Y+b9+1AAJk5Jxddae5okBXo9oaKu0m8gzbgyEnzGByY1hg@mail.gmail.com>
 <20171108074742.GA28177@gondor.apana.org.au>
 <CACT4Y+a_0grrUjrovW=0=0UPkH3pE_HpncDc3uBzwR_YtDURPA@mail.gmail.com>
 <20171109113857.GA15280@gondor.apana.org.au>
 <20171110020459.GA22329@gondor.apana.org.au>
 <20171110021145.GB22329@gondor.apana.org.au>
 <20171110023038.GA22532@gondor.apana.org.au>
 <20171110031406.GA22823@gondor.apana.org.au>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <20171110031406.GA22823@gondor.apana.org.au>
User-Agent: Mutt/1.5.24 (2015-08-30)
X-G-Data-MailSecurity-for-Exchange-Sender: 23
X-G-Data-MailSecurity-for-Exchange-Server: d65e63f7-5c15-413f-8f63-c0d707471c93
X-EXCLAIMER-MD-CONFIG: 2c86f778-e09b-4440-8b15-867914633a10
X-G-Data-MailSecurity-for-Exchange-Guid: 6B969C6A-853A-46A6-B59B-118897902AFF
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, Nov 10, 2017 at 02:14:06PM +1100, Herbert Xu wrote:
> On Fri, Nov 10, 2017 at 01:30:38PM +1100, Herbert Xu wrote:
> > 
> > I found the problem.  This crap is coming from clone_policy.  Now
> > let me where this code came from.
> 
> ---8<---
> Subject: xfrm: Copy policy family in clone_policy
> 
> The syzbot found an ancient bug in the IPsec code.  When we cloned
> a socket policy (for example, for a child TCP socket derived from a
> listening socket), we did not copy the family field.  This results
> in a live policy with a zero family field.  This triggers a BUG_ON
> check in the af_key code when the cloned policy is retrieved.
> 
> This patch fixes it by copying the family field over.
> 
> Reported-by: syzbot <syzkaller@googlegroups.com>
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Patch applied, thanks Herbert!

From 1583647264441938552@xxx Fri Nov 10 03:15:22 +0000 2017
X-GM-THRID: 1582152126679172657
X-Gmail-Labels: Inbox,Category Forums,HistoricalUnread