Received: by 10.223.185.116 with SMTP id b49csp1086106wrg; Fri, 23 Feb 2018 11:40:40 -0800 (PST) X-Google-Smtp-Source: AH8x224KtA1HVmYWEbQbDmvKd3OX+gZ0U7O0sz9hPziNYXr1Bg6QnS3Lek39pDnnbzqJeiP6hhtp X-Received: by 2002:a17:902:4003:: with SMTP id b3-v6mr2682077pld.154.1519414840078; Fri, 23 Feb 2018 11:40:40 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519414840; cv=none; d=google.com; s=arc-20160816; b=DRcdkKMtPzgP0fCORfnHoMlJyUblBoIeYDSiysJGaJfY9P4N1dpLdu7u33yQCFbCjE LU2vEqmGTjLHPeG8I40gvx0Fa2k9D3nPtBjC9Fna9iAwASb2JntshuKwbJYbdI5bA91m x8i+5wtjHDVFSE/mmHYddBircVuTFNOXKcgkTs+pirWsokOTvg94tA4c0ZUvZ5puDfH9 BZ1HH2OqXdCZ9IYxoHehMA02eODiWwRLWvrpAk7XBqRxw059h5MmAGRy1uluE6Gk6P6v Yi6Y0CJoy8rdQtUN83JKn4KWAEpTybE2zEPHd9cSyfxVvaYOFlVWcNNeNrn5UCWY8elS mTow== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=r5j4rBl/FIf8MbeziS+r86qVGy7AfVNtFCObx1VTbPA=; b=vEgowZcYyJrmBJSL3usadzXVamVF+/kzOVafQyIRwUIHbCz3Bjys+zPzegGmvXCXeA Xep6avYwlOr0GDpmdxUpaQ3bfRWGvcKh/focVZbu6557QBcxfTzCZ7/Ern8glNgWt5x2 EY5LldBDhr4qA/Tf8gx/f8c8f+yGWEbP1K3Bxa9j4X++A9tfzG9uzl09oBjJsWiaufBC xCRo+2JvuD9gTY3oxUeQsdGpKys6yPfW69CfJfUyreVoru4bMgYe+P93jt1wvxlEeSTh AHC5CkY4MTYyDVeFQ+666bMt27ThK4h2oFefJQ2PWbV75be0BnRkhOY93KHcKj3vdaSY v8jQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id n18si2272916pfj.58.2018.02.23.11.40.25; Fri, 23 Feb 2018 11:40:40 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932122AbeBWTjt (ORCPT + 99 others); Fri, 23 Feb 2018 14:39:49 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:45370 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934296AbeBWSth (ORCPT ); Fri, 23 Feb 2018 13:49:37 -0500 Received: from localhost (LFbn-1-12258-90.w90-92.abo.wanadoo.fr [90.92.71.90]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 0D6B2118E; Fri, 23 Feb 2018 18:49:36 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot , Steffen Klassert Subject: [PATCH 4.14 015/159] xfrm: Fix stack-out-of-bounds read on socket policy lookup. Date: Fri, 23 Feb 2018 19:25:23 +0100 Message-Id: <20180223170745.075446285@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180223170743.086611315@linuxfoundation.org> References: <20180223170743.086611315@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Steffen Klassert commit ddc47e4404b58f03e98345398fb12d38fe291512 upstream. When we do tunnel or beet mode, we pass saddr and daddr from the template to xfrm_state_find(), this is ok. On transport mode, we pass the addresses from the flowi, assuming that the IP addresses (and address family) don't change during transformation. This assumption is wrong in the IPv4 mapped IPv6 case, packet is IPv4 and template is IPv6. Fix this by catching address family missmatches of the policy and the flow already before we do the lookup. Reported-by: syzbot Signed-off-by: Steffen Klassert Signed-off-by: Greg Kroah-Hartman --- net/xfrm/xfrm_policy.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -1168,9 +1168,15 @@ static struct xfrm_policy *xfrm_sk_polic again: pol = rcu_dereference(sk->sk_policy[dir]); if (pol != NULL) { - bool match = xfrm_selector_match(&pol->selector, fl, family); + bool match; int err = 0; + if (pol->family != family) { + pol = NULL; + goto out; + } + + match = xfrm_selector_match(&pol->selector, fl, family); if (match) { if ((sk->sk_mark & pol->mark.m) != pol->mark.v) { pol = NULL;