Re: [PATCH] xfrm: fix crash in XFRM_MSG_GETSA netlink handler

2016-07-19 Thread Steffen Klassert
On Sun, Jul 10, 2016 at 02:21:13PM +0200, Steffen Klassert wrote: > On Wed, Jul 06, 2016 at 10:27:29AM +0800, Herbert Xu wrote: > > On Tue, Jul 05, 2016 at 12:13:03PM -0700, David Miller wrote: > > > From: Vegard Nossum > > > Date: Tue, 5 Jul 2016 10:18:08 +0200 > > > > > > > If we hit any of th

Re: [PATCH] xfrm: fix crash in XFRM_MSG_GETSA netlink handler

2016-07-10 Thread Steffen Klassert
On Wed, Jul 06, 2016 at 10:27:29AM +0800, Herbert Xu wrote: > On Tue, Jul 05, 2016 at 12:13:03PM -0700, David Miller wrote: > > From: Vegard Nossum > > Date: Tue, 5 Jul 2016 10:18:08 +0200 > > > > > If we hit any of the error conditions inside xfrm_dump_sa(), then > > > xfrm_state_walk_init() ne

Re: [PATCH] xfrm: fix crash in XFRM_MSG_GETSA netlink handler

2016-07-05 Thread Herbert Xu
On Tue, Jul 05, 2016 at 12:13:03PM -0700, David Miller wrote: > From: Vegard Nossum > Date: Tue, 5 Jul 2016 10:18:08 +0200 > > > If we hit any of the error conditions inside xfrm_dump_sa(), then > > xfrm_state_walk_init() never gets called. However, we still call > > xfrm_state_walk_done() from

Re: [PATCH] xfrm: fix crash in XFRM_MSG_GETSA netlink handler

2016-07-05 Thread David Miller
From: Vegard Nossum Date: Tue, 5 Jul 2016 10:18:08 +0200 > If we hit any of the error conditions inside xfrm_dump_sa(), then > xfrm_state_walk_init() never gets called. However, we still call > xfrm_state_walk_done() from xfrm_dump_sa_done(), which will crash > because the state walk was never i

Re: [PATCH] xfrm: fix crash in XFRM_MSG_GETSA netlink handler

2016-07-05 Thread Nicolas Dichtel
Le 05/07/2016 10:18, Vegard Nossum a écrit : > If we hit any of the error conditions inside xfrm_dump_sa(), then > xfrm_state_walk_init() never gets called. However, we still call > xfrm_state_walk_done() from xfrm_dump_sa_done(), which will crash > because the state walk was never initialized prop

[PATCH] xfrm: fix crash in XFRM_MSG_GETSA netlink handler

2016-07-05 Thread Vegard Nossum
If we hit any of the error conditions inside xfrm_dump_sa(), then xfrm_state_walk_init() never gets called. However, we still call xfrm_state_walk_done() from xfrm_dump_sa_done(), which will crash because the state walk was never initialized properly. We can fix this by setting cb->args[0] only af