lkml.org 
[lkml]   [2018]   [Feb]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 015/159] xfrm: Fix stack-out-of-bounds read on socket policy lookup.
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Steffen Klassert <steffen.klassert@secunet.com>

    commit ddc47e4404b58f03e98345398fb12d38fe291512 upstream.

    When we do tunnel or beet mode, we pass saddr and daddr from the
    template to xfrm_state_find(), this is ok. On transport mode,
    we pass the addresses from the flowi, assuming that the IP
    addresses (and address family) don't change during transformation.
    This assumption is wrong in the IPv4 mapped IPv6 case, packet
    is IPv4 and template is IPv6.

    Fix this by catching address family missmatches of the policy
    and the flow already before we do the lookup.

    Reported-by: syzbot <syzkaller@googlegroups.com>
    Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/xfrm/xfrm_policy.c | 8 +++++++-
    1 file changed, 7 insertions(+), 1 deletion(-)

    --- a/net/xfrm/xfrm_policy.c
    +++ b/net/xfrm/xfrm_policy.c
    @@ -1168,9 +1168,15 @@ static struct xfrm_policy *xfrm_sk_polic
    again:
    pol = rcu_dereference(sk->sk_policy[dir]);
    if (pol != NULL) {
    - bool match = xfrm_selector_match(&pol->selector, fl, family);
    + bool match;
    int err = 0;

    + if (pol->family != family) {
    + pol = NULL;
    + goto out;
    + }
    +
    + match = xfrm_selector_match(&pol->selector, fl, family);
    if (match) {
    if ((sk->sk_mark & pol->mark.m) != pol->mark.v) {
    pol = NULL;

    \
     
     \ /
      Last update: 2018-02-23 20:40    [W:4.471 / U:0.156 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site