Re: [PATCH v2] xfrm: Reset secpath in xfrm failure

2019-03-06 Thread Myungho Jung
On Wed, Mar 06, 2019 at 02:31:25PM -0800, Eric Dumazet wrote: > > > On 03/06/2019 01:55 PM, Myungho Jung wrote: > > In esp4_gro_receive() and esp6_gro_receive(), secpath can be allocated > > without adding xfrm state to xvec. Then, sp->xvec[sp->len - 1] would > > fail and result in dereferencing

Re: [PATCH v2] xfrm: Reset secpath in xfrm failure

2019-03-06 Thread Eric Dumazet
On 03/06/2019 01:55 PM, Myungho Jung wrote: > In esp4_gro_receive() and esp6_gro_receive(), secpath can be allocated > without adding xfrm state to xvec. Then, sp->xvec[sp->len - 1] would > fail and result in dereferencing invalid pointer in esp4_gso_segment() > and esp6_gso_segment(). Reset sec

[PATCH v2] xfrm: Reset secpath in xfrm failure

2019-03-06 Thread Myungho Jung
In esp4_gro_receive() and esp6_gro_receive(), secpath can be allocated without adding xfrm state to xvec. Then, sp->xvec[sp->len - 1] would fail and result in dereferencing invalid pointer in esp4_gso_segment() and esp6_gso_segment(). Reset secpath if xfrm function returns error. Fixes: 7785bba299