On Fri, Nov 10, 2017 at 02:14:06PM +1100, Herbert Xu wrote:
> On Fri, Nov 10, 2017 at 01:30:38PM +1100, Herbert Xu wrote:
> >
> > I found the problem. This crap is coming from clone_policy. Now
> > let me where this code came from.
>
> ---8<---
> Subject: xfrm: Copy policy family in clone_policy
>
> The syzbot found an ancient bug in the IPsec code. When we cloned
> a socket policy (for example, for a child TCP socket derived from a
> listening socket), we did not copy the family field. This results
> in a live policy with a zero family field. This triggers a BUG_ON
> check in the af_key code when the cloned policy is retrieved.
>
> This patch fixes it by copying the family field over.
>
> Reported-by: syzbot <[email protected]>
> Signed-off-by: Herbert Xu <[email protected]>
Patch applied, thanks Herbert!
From 1583647264441938552@xxx Fri Nov 10 03:15:22 +0000 2017
X-GM-THRID: 1582152126679172657
X-Gmail-Labels: Inbox,Category Forums,HistoricalUnread