On Fri, Mar 22, 2019 at 04:26:19PM -0700, Cong Wang wrote:
> In commit 6a53b7593233 ("xfrm: check id proto in validate_tmpl()")
> I introduced a check for xfrm protocol, but according to Herbert
> IPSEC_PROTO_ANY should only be used as a wildcard for lookup, so
> it should be removed from validate_tmpl().
>
> And, IPSEC_PROTO_ANY is expected to only match 3 IPSec-specific
> protocols, this is why xfrm_state_flush() could still miss
> IPPROTO_ROUTING, which leads that those entries are left in
> net->xfrm.state_all before exit net. Fix this by replacing
> IPSEC_PROTO_ANY with zero.
>
> This patch also extracts the check from validate_tmpl() to
> xfrm_id_proto_valid() and uses it in parse_ipsecrequest().
> With this, no other protocols should be added into xfrm.
>
> Fixes: 6a53b7593233 ("xfrm: check id proto in validate_tmpl()")
> Reported-by: syzbot+0bf0519d6e0de1591...@syzkaller.appspotmail.com
> Cc: Steffen Klassert <steffen.klass...@secunet.com>
> Cc: Herbert Xu <herb...@gondor.apana.org.au>
> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com>
> ---
> include/net/xfrm.h | 17 +++++++++++++++++
> net/ipv6/xfrm6_tunnel.c | 2 +-
> net/key/af_key.c | 4 +++-
> net/xfrm/xfrm_state.c | 2 +-
> net/xfrm/xfrm_user.c | 14 +-------------
> 5 files changed, 23 insertions(+), 16 deletions(-)
Acked-by: Herbert Xu <herb...@gondor.apana.org.au>
Thanks,
--
Email: Herbert Xu <herb...@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
