xfrm: Fix stack-out-of-bounds read on socket policy lookup.
When we do tunnel or beet mode, we pass saddr and daddr from the template to xfrm_state_find(), this is ok. On transport mode, we pass the addresses from the flowi, assuming that the IP addresses (and address family) don't change during transformation. This assumption is wrong in the IPv4 mapped IPv6 case, packet is IPv4 and template is IPv6. Fix this by catching address family missmatches of the policy and the flow already before we do the lookup. Change-Id: I4e3da03ed3b8f0cf0fdd01d5cdc8a69e9504240b Git-commit: ddc47e4404b58f03e98345398fb12d38fe291512 Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> [tejaswit@codeaurora.org : resolved minor conflicts. ] Signed-off-by: Tejaswi Tanikella <tejaswit@codeaurora.org>
This commit is contained in:
parent
59ad2b2992
commit
6379585c61
|
@ -1099,9 +1099,15 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
|
|||
|
||||
read_lock_bh(&xfrm_policy_lock);
|
||||
if ((pol = sk->sk_policy[dir]) != NULL) {
|
||||
bool match = xfrm_selector_match(&pol->selector, fl, family);
|
||||
bool match;
|
||||
int err = 0;
|
||||
|
||||
if (pol->family != family) {
|
||||
pol = NULL;
|
||||
goto out;
|
||||
}
|
||||
|
||||
match = xfrm_selector_match(&pol->selector, fl, family);
|
||||
if (match) {
|
||||
if ((sk->sk_mark & pol->mark.m) != pol->mark.v) {
|
||||
pol = NULL;
|
||||
|
|
Loading…
Reference in New Issue