From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steffen Klassert Subject: Re: kernel BUG at net/key/af_key.c:LINE! Date: Wed, 15 Nov 2017 12:29:19 +0100 Message-ID: <20171115112919.GT11292@secunet.com> References: <001a114a958ce46160055c4c4f66@google.com> <20171108074742.GA28177@gondor.apana.org.au> <20171109113857.GA15280@gondor.apana.org.au> <20171110020459.GA22329@gondor.apana.org.au> <20171110021145.GB22329@gondor.apana.org.au> <20171110023038.GA22532@gondor.apana.org.au> <20171110031406.GA22823@gondor.apana.org.au> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Cc: Dmitry Vyukov , syzbot , David Miller , LKML , netdev , To: Herbert Xu Return-path: Content-Disposition: inline In-Reply-To: <20171110031406.GA22823@gondor.apana.org.au> Sender: linux-kernel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org On Fri, Nov 10, 2017 at 02:14:06PM +1100, Herbert Xu wrote: > On Fri, Nov 10, 2017 at 01:30:38PM +1100, Herbert Xu wrote: > > > > I found the problem. This crap is coming from clone_policy. Now > > let me where this code came from. > > ---8<--- > Subject: xfrm: Copy policy family in clone_policy > > The syzbot found an ancient bug in the IPsec code. When we cloned > a socket policy (for example, for a child TCP socket derived from a > listening socket), we did not copy the family field. This results > in a live policy with a zero family field. This triggers a BUG_ON > check in the af_key code when the cloned policy is retrieved. > > This patch fixes it by copying the family field over. > > Reported-by: syzbot > Signed-off-by: Herbert Xu Patch applied, thanks Herbert!