Commit ddc47e44 authored Nov 29, 2017 by Steffen Klassert

xfrm: Fix stack-out-of-bounds read on socket policy lookup.



When we do tunnel or beet mode, we pass saddr and daddr from the
template to xfrm_state_find(), this is ok. On transport mode,
we pass the addresses from the flowi, assuming that the IP
addresses (and address family) don't change during transformation.
This assumption is wrong in the IPv4 mapped IPv6 case, packet
is IPv4 and template is IPv6.

Fix this by catching address family missmatches of the policy
and the flow already before we do the lookup.

Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

parent 4ce3dbe3

net/xfrm/xfrm_policy.c

+7 −1

Original line number	Diff line number	Diff line
		@@ -1168,9 +1168,15 @@ static struct xfrm_policy xfrm_sk_policy_lookup(const struct sock sk, int dir,
		again:
		pol = rcu_dereference(sk->sk_policy[dir]);
		if (pol != NULL) {
		bool match = xfrm_selector_match(&pol->selector, fl, family);
		bool match;
		int err = 0;

		if (pol->family != family) {
		pol = NULL;
		goto out;
		}

		match = xfrm_selector_match(&pol->selector, fl, family);
		if (match) {
		if ((sk->sk_mark & pol->mark.m) != pol->mark.v) {
		pol = NULL;

Admin message