On Sat, Dec 26, 2020 at 04:50:20PM -0800, Cong Wang wrote: > From: Cong Wang <cong.w...@bytedance.com> > > xfrm_probe_algs() probes kernel crypto modules and changes the > availability of struct xfrm_algo_desc. But there is a small window > where ealg->available and aalg->available get changed between > count_ah_combs()/count_esp_combs() and dump_ah_combs()/dump_esp_combs(), > in this case we may allocate a smaller skb but later put a larger > amount of data and trigger the panic in skb_put(). > > Fix this by relaxing the checks when counting the size, that is, > skipping the test of ->available. We may waste some memory for a few > of sizeof(struct sadb_comb), but it is still much better than a panic. > > Reported-by: syzbot+b2bf2652983d23734...@syzkaller.appspotmail.com > Cc: Steffen Klassert <steffen.klass...@secunet.com> > Cc: Herbert Xu <herb...@gondor.apana.org.au> > Signed-off-by: Cong Wang <cong.w...@bytedance.com>
Patch applied, thanks!
