From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1757738AbdKOL3a (ORCPT <rfc822;w@1wt.eu>);
        Wed, 15 Nov 2017 06:29:30 -0500
Received: from a.mx.secunet.com ([62.96.220.36]:56834 "EHLO a.mx.secunet.com"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1752843AbdKOL3Y (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
        Wed, 15 Nov 2017 06:29:24 -0500
Date: Wed, 15 Nov 2017 12:29:19 +0100
From: Steffen Klassert <steffen.klassert@secunet.com>
To: Herbert Xu <herbert@gondor.apana.org.au>
CC: Dmitry Vyukov <dvyukov@google.com>,
        syzbot 
        <bot+413384116f7f7dab7903d54c53fc4af6a4441965@syzkaller.appspotmail.com>,
        David Miller <davem@davemloft.net>,
        LKML <linux-kernel@vger.kernel.org>, netdev <netdev@vger.kernel.org>,
        <syzkaller-bugs@googlegroups.com>
Subject: Re: kernel BUG at net/key/af_key.c:LINE!
Message-ID: <20171115112919.GT11292@secunet.com>
References: <001a114a958ce46160055c4c4f66@google.com>
 <CACT4Y+b9+1AAJk5Jxddae5okBXo9oaKu0m8gzbgyEnzGByY1hg@mail.gmail.com>
 <20171108074742.GA28177@gondor.apana.org.au>
 <CACT4Y+a_0grrUjrovW=0=0UPkH3pE_HpncDc3uBzwR_YtDURPA@mail.gmail.com>
 <20171109113857.GA15280@gondor.apana.org.au>
 <20171110020459.GA22329@gondor.apana.org.au>
 <20171110021145.GB22329@gondor.apana.org.au>
 <20171110023038.GA22532@gondor.apana.org.au>
 <20171110031406.GA22823@gondor.apana.org.au>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <20171110031406.GA22823@gondor.apana.org.au>
User-Agent: Mutt/1.5.24 (2015-08-30)
X-G-Data-MailSecurity-for-Exchange-State: 0
X-G-Data-MailSecurity-for-Exchange-Error: 0
X-G-Data-MailSecurity-for-Exchange-Sender: 23
X-G-Data-MailSecurity-for-Exchange-Server: d65e63f7-5c15-413f-8f63-c0d707471c93
X-EXCLAIMER-MD-CONFIG: 2c86f778-e09b-4440-8b15-867914633a10
X-G-Data-MailSecurity-for-Exchange-Guid: 6B969C6A-853A-46A6-B59B-118897902AFF
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, Nov 10, 2017 at 02:14:06PM +1100, Herbert Xu wrote:
> On Fri, Nov 10, 2017 at 01:30:38PM +1100, Herbert Xu wrote:
> > 
> > I found the problem.  This crap is coming from clone_policy.  Now
> > let me where this code came from.
> 
> ---8<---
> Subject: xfrm: Copy policy family in clone_policy
> 
> The syzbot found an ancient bug in the IPsec code.  When we cloned
> a socket policy (for example, for a child TCP socket derived from a
> listening socket), we did not copy the family field.  This results
> in a live policy with a zero family field.  This triggers a BUG_ON
> check in the af_key code when the cloned policy is retrieved.
> 
> This patch fixes it by copying the family field over.
> 
> Reported-by: syzbot <syzkaller@googlegroups.com>
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Patch applied, thanks Herbert!