From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-cys01nam02on0124.outbound.protection.outlook.com ([104.47.37.124]:11968 "EHLO NAM02-CY1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753813AbeA1W34 (ORCPT ); Sun, 28 Jan 2018 17:29:56 -0500 From: Sasha Levin To: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" CC: Steffen Klassert , Sasha Levin Subject: [PATCH AUTOSEL for 4.4 24/36] xfrm: Fix stack-out-of-bounds read on socket policy lookup. Date: Sun, 28 Jan 2018 22:28:40 +0000 Message-ID: <20180128222815.29479-24-alexander.levin@microsoft.com> References: <20180128222815.29479-1-alexander.levin@microsoft.com> In-Reply-To: <20180128222815.29479-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Steffen Klassert [ Upstream commit ddc47e4404b58f03e98345398fb12d38fe291512 ] When we do tunnel or beet mode, we pass saddr and daddr from the template to xfrm_state_find(), this is ok. On transport mode, we pass the addresses from the flowi, assuming that the IP addresses (and address family) don't change during transformation. This assumption is wrong in the IPv4 mapped IPv6 case, packet is IPv4 and template is IPv6. Fix this by catching address family missmatches of the policy and the flow already before we do the lookup. Reported-by: syzbot Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin --- net/xfrm/xfrm_policy.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 22df3b51e905..4b09a9eaa35f 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -1225,9 +1225,15 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(con= st struct sock *sk, int dir, read_lock_bh(&net->xfrm.xfrm_policy_lock); pol =3D rcu_dereference(sk->sk_policy[dir]); if (pol !=3D NULL) { - bool match =3D xfrm_selector_match(&pol->selector, fl, family); + bool match; int err =3D 0; =20 + if (pol->family !=3D family) { + pol =3D NULL; + goto out; + } + + match =3D xfrm_selector_match(&pol->selector, fl, family); if (match) { if ((sk->sk_mark & pol->mark.m) !=3D pol->mark.v) { pol =3D NULL; --=20 2.11.0