Sabrina Dubroca 9fcedabaae xfrm: xfrm_alloc_spi shouldn't use 0 as SPI ...

[ Upstream commit cd8ae32e4e ]

x->id.spi == 0 means "no SPI assigned", but since commit
94f39804d8 ("xfrm: Duplicate SPI Handling"), we now create states
and add them to the byspi list with this value.

__xfrm_state_delete doesn't remove those states from the byspi list,
since they shouldn't be there, and this shows up as a UAF the next
time we go through the byspi list.

Reported-by: syzbot+a25ee9d20d31e483ba7b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a25ee9d20d31e483ba7b
Fixes: 94f39804d8 ("xfrm: Duplicate SPI Handling")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2025-10-02 13:44:09 +02:00

..

espintcp.c

espintcp: fix skb leaks

2025-05-29 11:03:13 +02:00

Kconfig

…

Makefile

xfrm: support sending NAT keepalives in ESP in UDP states

2024-06-26 13:22:42 +02:00

xfrm_algo.c

…

xfrm_compat.c

xfrm: Add support for per cpu xfrm state handling.

2025-02-08 09:58:00 +01:00

xfrm_device.c

xfrm: Use xdo.dev instead of xdo.real_dev

2025-06-19 15:31:43 +02:00

xfrm_hash.c

…

xfrm_hash.h

…

xfrm_inout.h

…

xfrm_input.c

xfrm: Add an inbound percpu state cache.

2025-02-08 09:58:00 +01:00

xfrm_interface_bpf.c

…

xfrm_interface_core.c

xfrm: interface: fix use-after-free after changing collect_md xfrm interface

2025-08-01 09:48:41 +01:00

xfrm_ipcomp.c

…

xfrm_nat_keepalive.c

xfrm: support sending NAT keepalives in ESP in UDP states

2024-06-26 13:22:42 +02:00

xfrm_output.c

xfrm_output: Force software GSO only in tunnel mode

2025-03-28 22:03:25 +01:00

xfrm_policy.c

xfrm: Sanitize marks before insert

2025-05-29 11:03:15 +02:00

xfrm_proc.c

xfrm: Add dir validation to "in" data path lookup

2024-05-01 10:06:27 +02:00

xfrm_replay.c

xfrm: replay: Fix the update of replay_esn->oseq_hi for GSO

2025-02-08 09:58:00 +01:00

xfrm_state_bpf.c

…

xfrm_state.c

xfrm: xfrm_alloc_spi shouldn't use 0 as SPI

2025-10-02 13:44:09 +02:00

xfrm_sysctl.c

net: Remove ctl_table sentinel elements from several networking subsystems

2024-05-03 13:29:42 +01:00

xfrm_user.c

xfrm: validate assignment of maximal possible SEQ number

2025-06-27 11:11:31 +01:00