Steffen Klassert 013cb81e89 xfrm: Fix infinite loop in xfrm_get_dst_nexthop with transport mode. ...

On transport mode we forget to fetch the child dst_entry
before we continue the while loop, this leads to an infinite
loop. Fix this by fetching the child dst_entry before we
continue the while loop.

Fixes: 0f6c480f23 ("xfrm: Move dst->path into struct xfrm_dst")
Reported-by: syzbot+7d03c810e50aaedef98a@syzkaller.appspotmail.com
Tested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

2018-02-20 08:38:57 +01:00

78 KiB

Raw Blame History

View Raw