xfrm: Fix stack-out-of-bounds read in xfrm_state_find. (c9f3f813) · Commits · 戴 / test

When we do tunnel or beet mode, we pass saddr and daddr from the template to xfrm_state_find(), this is ok. On transport mode, we pass the addresses from the flowi, assuming that the IP addresses (and address family) don't change during transformation. This assumption is wrong in the IPv4 mapped IPv6 case, packet is IPv4 and template is IPv6. Fix this by using the addresses from the template unconditionally. Signed-off-by:

Steffen Klassert <steffen.klassert@secunet.com>

net/xfrm/xfrm_policy.c

+11 −18

Original line number	Diff line number	Diff line
		@@ -1361,18 +1361,14 @@ xfrm_tmpl_resolve_one(struct xfrm_policy policy, const struct flowi fl,
		struct net *net = xp_net(policy);
		int nx;
		int i, error;
		xfrm_address_t *daddr = xfrm_flowi_daddr(fl, family);
		xfrm_address_t *saddr = xfrm_flowi_saddr(fl, family);
		xfrm_address_t tmp;

		for (nx = 0, i = 0; i < policy->xfrm_nr; i++) {
		struct xfrm_state *x;
		xfrm_address_t *remote = daddr;
		xfrm_address_t *local = saddr;
		xfrm_address_t *local;
		xfrm_address_t *remote;
		struct xfrm_tmpl *tmpl = &policy->xfrm_vec[i];

		if (tmpl->mode == XFRM_MODE_TUNNEL \|\|
		tmpl->mode == XFRM_MODE_BEET) {
		remote = &tmpl->id.daddr;
		local = &tmpl->saddr;
		if (xfrm_addr_any(local, tmpl->encap_family)) {
		@@ -1383,14 +1379,11 @@ xfrm_tmpl_resolve_one(struct xfrm_policy policy, const struct flowi fl,
		goto fail;
		local = &tmp;
		}
		}

		x = xfrm_state_find(remote, local, fl, tmpl, policy, &error, family);

		if (x && x->km.state == XFRM_STATE_VALID) {
		xfrm[nx++] = x;
		daddr = remote;
		saddr = local;
		continue;
		}
		if (x) {

Admin message