On Mon, Mar 25, 2019 at 06:42:58PM +0800, Herbert Xu wrote:
> On Fri, Mar 22, 2019 at 04:26:19PM -0700, Cong Wang wrote:
> > In commit 6a53b7593233 ("xfrm: check id proto in validate_tmpl()")
> > I introduced a check for xfrm protocol, but according to Herbert
> > IPSEC_PROTO_ANY should only be used as a wildcard for lookup, so
> > it should be removed from validate_tmpl().
> >
> > And, IPSEC_PROTO_ANY is expected to only match 3 IPSec-specific
> > protocols, this is why xfrm_state_flush() could still miss
> > IPPROTO_ROUTING, which leads that those entries are left in
> > net->xfrm.state_all before exit net. Fix this by replacing
> > IPSEC_PROTO_ANY with zero.
> >
> > This patch also extracts the check from validate_tmpl() to
> > xfrm_id_proto_valid() and uses it in parse_ipsecrequest().
> > With this, no other protocols should be added into xfrm.
> >
> > Fixes: 6a53b7593233 ("xfrm: check id proto in validate_tmpl()")
> > Reported-by: syzbot+0bf0519d6e0de1591...@syzkaller.appspotmail.com
> > Cc: Steffen Klassert <steffen.klass...@secunet.com>
> > Cc: Herbert Xu <herb...@gondor.apana.org.au>
> > Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com>
> > ---
> > include/net/xfrm.h | 17 +++++++++++++++++
> > net/ipv6/xfrm6_tunnel.c | 2 +-
> > net/key/af_key.c | 4 +++-
> > net/xfrm/xfrm_state.c | 2 +-
> > net/xfrm/xfrm_user.c | 14 +-------------
> > 5 files changed, 23 insertions(+), 16 deletions(-)
>
> Acked-by: Herbert Xu <herb...@gondor.apana.org.au>
>
Patch applied, thanks everyone!
