From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Cyrus-Session-Id: sloti22d1t05-1369136-1517180484-2-8493989353367964378 X-Sieve: CMU Sieve 3.0 X-Spam-known-sender: no X-Spam-score: 0.0 X-Spam-hits: BAYES_00 -1.9, HEADER_FROM_DIFFERENT_DOMAINS 0.001, RCVD_IN_DNSWL_HI -5, T_RP_MATCHES_RCVD -0.01, LANGUAGES en, BAYES_USED global, SA_VERSION 3.4.0 X-Spam-source: IP='209.132.180.67', Host='vger.kernel.org', Country='US', FromHeader='com', MailFrom='org', XOriginatingCountry='US' X-Spam-charsets: plain='iso-8859-1' X-Resolved-to: greg@kroah.com X-Delivered-to: greg@kroah.com X-Mail-from: stable-owner@vger.kernel.org ARC-Seal: i=1; a=rsa-sha256; cv=none; d=messagingengine.com; s=arctest; t=1517180483; b=Ku3IJKvdVP6S75l+Xd/T/AgF+VE2FHW7sqRdoTE0KItc0EW uRKLpyg2N7m3GL1JBKkRpqs37WhrVblYYB/U6lNeFLx1nT7EYBWC0ebuUns0+ksb oKdnG0I249Cjoc4QRMrc1CU5iUUfQkfHIcN5qZ4UmohzL4e65fPvTVUgGDk979h/ NQw0mgjWcS1d/VZ/iTF0rmZKmfCtirZnfiR6V3yu1TI434F6COxIzdUJfc0i5eTa OhLJs4G/FhPxSdySw8gpGlwy3E2VIUTw7T0bFSTDSpz+GDta/RoVBANYL1czubl/ cX38ZuburUhonMKhSBlPshAjmvDL7Oz+M9xurXA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=from:to:cc:subject:date:message-id :references:in-reply-to:content-type:content-transfer-encoding :mime-version:sender:list-id; s=arctest; t=1517180483; bh=fZ+BSW 3qrSEMRr4k1CfJG6A0nhW++xYOAq6pwRx7Rmk=; b=sDQTW7nlWRAir8SIv2Rwym p4G8fVgLMImYQ2WzE30bKeQ7oKCLPpxaOTismGUuAvyOVPsXucfLKBeLW5wo8DXA v8QI83CCenm5OsPxYIpC4QKuHeZQRbeymkPGh32nA4QlYv+EekCXMzu8sZhEYGMv 4c8HXbaGEX+Kl0VDwAn5rDHSG74+xEPyTpU64RW9Dhj1KtaJD83XkitFNM+lwUFU 17jVgu+aO16gJ0d1uyhYQwm+j/mVnJttBpnP4ZBSk3ny3dALrvfMfv8c0RbmnQGl HNMsSZAhlW1GzXwE6piqwO0VGntjuxT3O21EiJbLgH9Ex2epVFFvIedDO+lFhqSA == ARC-Authentication-Results: i=1; mx3.messagingengine.com; arc=none (no signatures found); dkim=pass (1024-bit rsa key sha256) header.d=microsoft.com header.i=@microsoft.com header.b=Qdg+VdeX x-bits=1024 x-keytype=rsa x-algorithm=sha256 x-selector=selector1; dmarc=pass (p=reject,has-list-id=yes,d=none) header.from=microsoft.com; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=microsoft.com header.result=pass header_is_org_domain=yes Authentication-Results: mx3.messagingengine.com; arc=none (no signatures found); dkim=pass (1024-bit rsa key sha256) header.d=microsoft.com header.i=@microsoft.com header.b=Qdg+VdeX x-bits=1024 x-keytype=rsa x-algorithm=sha256 x-selector=selector1; dmarc=pass (p=reject,has-list-id=yes,d=none) header.from=microsoft.com; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=microsoft.com header.result=pass header_is_org_domain=yes Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753537AbeA1W1t (ORCPT ); Sun, 28 Jan 2018 17:27:49 -0500 Received: from mail-bn3nam01on0128.outbound.protection.outlook.com ([104.47.33.128]:55858 "EHLO NAM01-BN3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753510AbeA1W1r (ORCPT ); Sun, 28 Jan 2018 17:27:47 -0500 From: Sasha Levin To: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" CC: Steffen Klassert , Sasha Levin Subject: [PATCH AUTOSEL for 4.14 077/100] xfrm: Fix stack-out-of-bounds read on socket policy lookup. Thread-Topic: [PATCH AUTOSEL for 4.14 077/100] xfrm: Fix stack-out-of-bounds read on socket policy lookup. Thread-Index: AQHTmIcWQo4PXp4AyEmKZqct/QxZDw== Date: Sun, 28 Jan 2018 22:26:49 +0000 Message-ID: <20180128222547.7398-77-alexander.levin@microsoft.com> References: <20180128222547.7398-1-alexander.levin@microsoft.com> In-Reply-To: <20180128222547.7398-1-alexander.levin@microsoft.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [52.168.54.252] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1;MW2PR2101MB1018;7:ZLvsu/IMb+/QUul+Off+aw8pk7w/Gg1+0NMhSAv6+DdsnMfKGCYftdEVY1C3D2msmmysX/+U1iy6ieUTvYRZWHi9QJ9ccolEytbCI111WI8wPiZLhZ9EKtL0deyCe2ytubFVUO06SXu37/LvZW90X4ag0NiSR1qKfZQD06yk59WWz4T03SbnKFi5HVBGK5Urb7a/ieZJW/OqX2GWH1rhkGYFrlhR0vaTGuCYQN5fE+qo+IOu+mbLbEzAg9/6bs/j x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: b6f1110e-02ff-459e-c4f7-08d5669e571b x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(7020095)(4652020)(4534165)(4627221)(201703031133081)(201702281549075)(48565401081)(5600026)(4604075)(3008032)(2017052603307)(7193020);SRVR:MW2PR2101MB1018; x-ms-traffictypediagnostic: MW2PR2101MB1018: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alexander.Levin@microsoft.com; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(215639381216008)(89211679590171); x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(61425038)(6040501)(2401047)(5005006)(8121501046)(3002001)(93006095)(93001095)(10201501046)(3231101)(944501161)(6055026)(61426038)(61427038)(6041288)(20161123558120)(20161123564045)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123562045)(6072148)(201708071742011);SRVR:MW2PR2101MB1018;BCL:0;PCL:0;RULEID:;SRVR:MW2PR2101MB1018; x-forefront-prvs: 05669A7924 x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(396003)(39380400002)(39860400002)(366004)(346002)(376002)(199004)(189003)(53936002)(2501003)(6436002)(86362001)(6486002)(5250100002)(26005)(102836004)(6512007)(59450400001)(76176011)(6116002)(2900100001)(3846002)(36756003)(305945005)(7736002)(316002)(3660700001)(22452003)(3280700002)(54906003)(110136005)(99286004)(186003)(97736004)(1076002)(86612001)(81166006)(6666003)(2906002)(106356001)(14454004)(66066001)(4326008)(68736007)(5660300001)(25786009)(8936002)(10290500003)(81156014)(72206003)(107886003)(10090500001)(478600001)(2950100002)(105586002)(8676002)(6506007)(22906009)(217873001);DIR:OUT;SFP:1102;SCL:1;SRVR:MW2PR2101MB1018;H:MW2PR2101MB1034.namprd21.prod.outlook.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; x-microsoft-antispam-message-info: 7tvFEpN4mD36uK0IIpQ/Aq7nfpf13QGzZeqL1b5LtScVwg1Nj7ZTPZCl/VzrDSSxh3tfyPX5DGa1PvQQiBH/LQ== spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: b6f1110e-02ff-459e-c4f7-08d5669e571b X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Jan 2018 22:26:49.1588 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW2PR2101MB1018 Sender: stable-owner@vger.kernel.org X-Mailing-List: stable@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-Mailing-List: linux-kernel@vger.kernel.org List-ID: From: Steffen Klassert [ Upstream commit ddc47e4404b58f03e98345398fb12d38fe291512 ] When we do tunnel or beet mode, we pass saddr and daddr from the template to xfrm_state_find(), this is ok. On transport mode, we pass the addresses from the flowi, assuming that the IP addresses (and address family) don't change during transformation. This assumption is wrong in the IPv4 mapped IPv6 case, packet is IPv4 and template is IPv6. Fix this by catching address family missmatches of the policy and the flow already before we do the lookup. Reported-by: syzbot Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin --- net/xfrm/xfrm_policy.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 6bc16bb61b55..50c5f46b5cca 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -1169,9 +1169,15 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(con= st struct sock *sk, int dir, again: pol =3D rcu_dereference(sk->sk_policy[dir]); if (pol !=3D NULL) { - bool match =3D xfrm_selector_match(&pol->selector, fl, family); + bool match; int err =3D 0; =20 + if (pol->family !=3D family) { + pol =3D NULL; + goto out; + } + + match =3D xfrm_selector_match(&pol->selector, fl, family); if (match) { if ((sk->sk_mark & pol->mark.m) !=3D pol->mark.v) { pol =3D NULL; --=20 2.11.0