Skip to content
Commit 6ed69184 authored by Myungho Jung's avatar Myungho Jung Committed by Steffen Klassert
Browse files

xfrm: Reset secpath in xfrm failure

In esp4_gro_receive() and esp6_gro_receive(), secpath can be allocated
without adding xfrm state to xvec. Then, sp->xvec[sp->len - 1] would
fail and result in dereferencing invalid pointer in esp4_gso_segment()
and esp6_gso_segment(). Reset secpath if xfrm function returns error.

Fixes: 7785bba2

 ("esp: Add a software GRO codepath")
Reported-by: default avatar <syzbot+b69368fd933c6c592f4c@syzkaller.appspotmail.com>
Signed-off-by: default avatarMyungho Jung <mhjungk@gmail.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent b805d78d
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment