When setting the extended skb data for sadb_x_ipsecrequest, the requested extended data size exceeds the allocated skb data length, triggering the reported bug. Because family only supports AF_INET and AF_INET6, other values will cause pfkey_sockaddr_fill() to fail, which in turn causes set_ipsecrequest() to fail. Therefore, a workaround is available here: using a family value of 0 to resolve the issue of excessively large extended data length. syzbot reported: kernel BUG at net/core/skbuff.c:212! Call Trace: skb_over_panic net/core/skbuff.c:217 [inline] skb_put+0x159/0x210 net/core/skbuff.c:2583 skb_put_zero include/linux/skbuff.h:2788 [inline] set_ipsecrequest+0x73/0x680 net/key/af_key.c:3532 Fixes: 08de61beab8a ("[PFKEYV2]: Extension for dynamic update of endpoint address(es)") Reported-by: syzbot+be97dd4da14ae88b6ba4@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=be97dd4da14ae88b6ba4 Signed-off-by: Edward Adam Davis --- net/key/af_key.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/key/af_key.c b/net/key/af_key.c index 2ebde0352245..e658c129b38f 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -3526,6 +3526,9 @@ static int set_ipsecrequest(struct sk_buff *skb, int socklen = pfkey_sockaddr_len(family); int size_req; + if (!family) + return -EINVAL; + size_req = sizeof(struct sadb_x_ipsecrequest) + pfkey_sockaddr_pair_size(family); -- 2.43.0