xfrm: Reset secpath in xfrm failure

In esp4_gro_receive() and esp6_gro_receive(), secpath can be allocated
without adding xfrm state to xvec. Then, sp->xvec[sp->len - 1] would
fail and result in dereferencing invalid pointer in esp4_gso_segment()
and esp6_gso_segment(). Reset secpath if xfrm function returns error.

Fixes: 7785bba299a8 ("esp: Add a software GRO codepath")
Reported-by: syzbot+b69368fd933c6c592f4c@syzkaller.appspotmail.com
Signed-off-by: Myungho Jung <mhjungk@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c
index 8756e0e790d2a94a5b4a587c3bc3de0673baf2c4..d3170a8001b2a15bffe5a37ab9e0b556663454a4 100644 (file)
--- a/net/ipv4/esp4_offload.c
+++ b/net/ipv4/esp4_offload.c
@@ -52,13 +52,13 @@ static struct sk_buff *esp4_gro_receive(struct list_head *head,
                        goto out;
 
                if (sp->len == XFRM_MAX_DEPTH)
-                       goto out;
+                       goto out_reset;
 
                x = xfrm_state_lookup(dev_net(skb->dev), skb->mark,
                                      (xfrm_address_t *)&ip_hdr(skb)->daddr,
                                      spi, IPPROTO_ESP, AF_INET);
                if (!x)
-                       goto out;
+                       goto out_reset;
 
                sp->xvec[sp->len++] = x;
                sp->olen++;
@@ -66,7 +66,7 @@ static struct sk_buff *esp4_gro_receive(struct list_head *head,
                xo = xfrm_offload(skb);
                if (!xo) {
                        xfrm_state_put(x);
-                       goto out;
+                       goto out_reset;
                }
        }
 
@@ -82,6 +82,8 @@ static struct sk_buff *esp4_gro_receive(struct list_head *head,
        xfrm_input(skb, IPPROTO_ESP, spi, -2);
 
        return ERR_PTR(-EINPROGRESS);
+out_reset:
+       secpath_reset(skb);
 out:
        skb_push(skb, offset);
        NAPI_GRO_CB(skb)->same_flow = 0;

diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c
index d46b4eb645c2e81993119b9a37405aa4b5eb82b3..cb99f6fb79b798702ecb87be006044fe06dda3c2 100644 (file)
--- a/net/ipv6/esp6_offload.c
+++ b/net/ipv6/esp6_offload.c
@@ -74,13 +74,13 @@ static struct sk_buff *esp6_gro_receive(struct list_head *head,
                        goto out;
 
                if (sp->len == XFRM_MAX_DEPTH)
-                       goto out;
+                       goto out_reset;
 
                x = xfrm_state_lookup(dev_net(skb->dev), skb->mark,
                                      (xfrm_address_t *)&ipv6_hdr(skb)->daddr,
                                      spi, IPPROTO_ESP, AF_INET6);
                if (!x)
-                       goto out;
+                       goto out_reset;
 
                sp->xvec[sp->len++] = x;
                sp->olen++;
@@ -88,7 +88,7 @@ static struct sk_buff *esp6_gro_receive(struct list_head *head,
                xo = xfrm_offload(skb);
                if (!xo) {
                        xfrm_state_put(x);
-                       goto out;
+                       goto out_reset;
                }
        }
 
@@ -109,6 +109,8 @@ static struct sk_buff *esp6_gro_receive(struct list_head *head,
        xfrm_input(skb, IPPROTO_ESP, spi, -2);
 
        return ERR_PTR(-EINPROGRESS);
+out_reset:
+       secpath_reset(skb);
 out:
        skb_push(skb, offset);
        NAPI_GRO_CB(skb)->same_flow = 0;