diff options
| author | Steffen Klassert <steffen.klassert@secunet.com> | 2017-02-14 07:43:56 +0100 |
|---|---|---|
| committer | Shirle Yuen <shirleyshukyee@google.com> | 2018-08-05 16:38:06 -0700 |
| commit | b4cf10dd8bfc8c772b453f68cf4d58be025723d2 (patch) | |
| tree | 20cbea4ef57f326442731d0c6ff04fb410ffbebf | |
| parent | 40118e05c4ed51aa23a73ceb069a337eb9ac59bb (diff) | |
| download | qcom-msm8x09-v3.10-b4cf10dd8bfc8c772b453f68cf4d58be025723d2.tar.gz | |
xfrm: Don't use sk_family for socket policy lookups
On IPv4-mapped IPv6 addresses sk_family is AF_INET6,
but the flow informations are created based on AF_INET.
So the routing set up 'struct flowi4' but we try to
access 'struct flowi6' what leads to an out of bounds
access. Fix this by using the family we get with the
dst_entry, like we do it for the standard policy lookup
Bug: 111289931
Change-Id: I5b8e44f5af10f18e05fd954c74482c1596733326
Git-commit: 4c86d77743a54fb2d8a4d18a037a074c892bb3be
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[tejaswit@codeaurora.org : resolved minor conflicts]
Signed-off-by: Tejaswi Tanikella <tejaswit@codeaurora.org>
(cherry picked from commit a5df724efb49f3427a8f7472948fa66277cd6626)
| -rw-r--r-- | net/xfrm/xfrm_policy.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index ea970b8002a..187ae19aa58 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -1093,14 +1093,13 @@ static inline int policy_to_flow_dir(int dir) } static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, - const struct flowi *fl) + const struct flowi *fl, u16 family) { struct xfrm_policy *pol; read_lock_bh(&xfrm_policy_lock); if ((pol = sk->sk_policy[dir]) != NULL) { - bool match = xfrm_selector_match(&pol->selector, fl, - sk->sk_family); + bool match = xfrm_selector_match(&pol->selector, fl, family); int err = 0; if (match) { @@ -2059,7 +2058,7 @@ restart: if (sk && sk->sk_policy[XFRM_POLICY_OUT]) { num_pols = 1; - pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl); + pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl, family); err = xfrm_expand_policies(fl, family, pols, &num_pols, &num_xfrms); if (err < 0) @@ -2337,7 +2336,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, pol = NULL; if (sk && sk->sk_policy[dir]) { - pol = xfrm_sk_policy_lookup(sk, dir, &fl); + pol = xfrm_sk_policy_lookup(sk, dir, &fl, family); if (IS_ERR(pol)) { XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR); return 0; |