Patch "xfrm: Copy policy family in clone_policy" has been added to the 3.18-stable tree

This is a note to let you know that I've just added the patch titled

xfrm: Copy policy family in clone_policy

to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
xfrm-copy-policy-family-in-clone_policy.patch
and it can be found in the queue-3.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Herbert Xu <[email protected]>
Date: Fri, 10 Nov 2017 14:14:06 +1100
Subject: xfrm: Copy policy family in clone_policy

From: Herbert Xu <[email protected]>

[ Upstream commit 0e74aa1d79a5bbc663e03a2804399cae418a0321 ]

The syzbot found an ancient bug in the IPsec code. When we cloned a socket policy (for example, for a child TCP socket derived from a listening socket), we did not copy the family field. This results in a live policy with a zero family field. This triggers a BUG_ON check in the af_key code when the cloned policy is retrieved.

This patch fixes it by copying the family field over.

---
 net/xfrm/xfrm_policy.c |    1 +
 1 file changed, 1 insertion(+)

@@ -1345,6 +1345,7 @@ static struct xfrm_policy *clone_policy(
 		newp->xfrm_nr = old->xfrm_nr;
 		newp->index = old->index;
 		newp->type = old->type;
+		newp->family = old->family;
 		memcpy(newp->xfrm_vec, old->xfrm_vec,
 		       newp->xfrm_nr*sizeof(struct xfrm_tmpl));
 		write_lock_bh(&net->xfrm.xfrm_policy_lock);

Patches currently in stable-queue which might be from [email protected] are

queue-3.18/xfrm-copy-policy-family-in-clone_policy.patch queue-3.18/crypto-s5p-sss-fix-completing-crypto-request-in-irq-handler.patch