mirror of
https://github.com/brain-hackers/linux-brain.git
synced 2024-06-09 15:26:21 +09:00
xfrm: Copy policy family in clone_policy
[ Upstream commit 0e74aa1d79
]
The syzbot found an ancient bug in the IPsec code. When we cloned
a socket policy (for example, for a child TCP socket derived from a
listening socket), we did not copy the family field. This results
in a live policy with a zero family field. This triggers a BUG_ON
check in the af_key code when the cloned policy is retrieved.
This patch fixes it by copying the family field over.
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
74b470ce47
commit
6ceabde666
|
@ -1393,6 +1393,7 @@ static struct xfrm_policy *clone_policy(const struct xfrm_policy *old, int dir)
|
|||
newp->xfrm_nr = old->xfrm_nr;
|
||||
newp->index = old->index;
|
||||
newp->type = old->type;
|
||||
newp->family = old->family;
|
||||
memcpy(newp->xfrm_vec, old->xfrm_vec,
|
||||
newp->xfrm_nr*sizeof(struct xfrm_tmpl));
|
||||
spin_lock_bh(&net->xfrm.xfrm_policy_lock);
|
||||
|
|
Loading…
Reference in New Issue
Block a user