Steffen Klassert 4ddb80f419 xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force clears the dst_entry. ... [ Upstream commit 0152eee6fc ] Since commit 222d7dbd25 ("net: prevent dst uses after free") skb_dst_force() might clear the dst_entry attached to the skb. The xfrm code doesn't expect this to happen, so we crash with a NULL pointer dereference in this case. Fix it by checking skb_dst(skb) for NULL after skb_dst_force() and drop the packet in case the dst_entry was cleared. We also move the skb_dst_force() to a codepath that is not used when the transformation was offloaded, because in this case we don't have a dst_entry attached to the skb. The output and forwarding path was already fixed by commit 9e14379378 ("xfrm: Fix NULL pointer dereference when skb_dst_force clears the dst_entry.") Fixes: 222d7dbd25 ("net: prevent dst uses after free") Reported-by: Jean-Philippe Menil <jpmenil@gmail.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-01-13 10:00:57 +01:00
..
Kconfig	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2017-02-16 21:25:49 -05:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xfrm_algo.c	xfrm: use IS_ENABLED() instead of checking for built-in or module	2016-09-10 21:19:11 -07:00
xfrm_device.c	xfrm: Fix negative device refcount on offload failure.	2017-09-11 10:36:51 +02:00
xfrm_hash.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xfrm_hash.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xfrm_input.c	xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force clears the dst_entry.	2019-01-13 10:00:57 +01:00
xfrm_ipcomp.c	net: xfrm: use preempt-safe this_cpu_read() in ipcomp_alloc_tfms()	2018-04-08 14:26:29 +02:00
xfrm_output.c	xfrm: Fix error return code in xfrm_output_one()	2019-01-13 10:00:57 +01:00
xfrm_policy.c	xfrm: policy: use hlist rcu variants on insert	2018-11-13 11:14:50 -08:00
xfrm_proc.c	proc: Reduce cache miss in xfrm_statistics_seq_show	2016-09-30 01:50:45 -04:00
xfrm_replay.c	xfrm: Fix ESN sequence number handling for IPsec GSO packets.	2018-05-30 07:52:08 +02:00
xfrm_state.c	xfrm: Fix bucket count reported to userspace	2019-01-13 10:00:57 +01:00
xfrm_sysctl.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xfrm_user.c	xfrm: validate template mode	2018-11-04 14:52:38 +01:00