Florian Westphal a19fd85be2 xfrm: refine validation of template and selector families ... commit 35e6103861 upstream. The check assumes that in transport mode, the first templates family must match the address family of the policy selector. Syzkaller managed to build a template using MODE_ROUTEOPTIMIZATION, with ipv4-in-ipv6 chain, leading to following splat: BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x1db/0x1854 Read of size 4 at addr ffff888063e57aa0 by task a.out/2050 xfrm_state_find+0x1db/0x1854 xfrm_tmpl_resolve+0x100/0x1d0 xfrm_resolve_and_create_bundle+0x108/0x1000 [..] Problem is that addresses point into flowi4 struct, but xfrm_state_find treats them as being ipv6 because it uses templ->encap_family is used (AF_INET6 in case of reproducer) rather than family (AF_INET). This patch inverts the logic: Enforce 'template family must match selector' EXCEPT for tunnel and BEET mode. In BEET and Tunnel mode, xfrm_tmpl_resolve_one will have remote/local address pointers changed to point at the addresses found in the template, rather than the flowi ones, so no oob read will occur. Reported-by: 3ntr0py1337@gmail.com Reported-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-02-15 08:07:39 +01:00
..
Kconfig	net/xfrm: remove depends on CONFIG_EXPERIMENTAL	2013-01-11 11:40:03 -08:00
Makefile	xfrm: make xfrm_algo.c a module	2012-05-15 13:13:34 -04:00
xfrm_algo.c	xfrm: use IS_ENABLED() instead of checking for built-in or module	2016-09-10 21:19:11 -07:00
xfrm_hash.c	net: allow GFP_HIGHMEM in __vmalloc()	2010-11-21 10:04:04 -08:00
xfrm_hash.h	xfrm: hash prefixed policies based on preflen thresholds	2014-09-02 13:29:44 +02:00
xfrm_input.c	net/xfrm_input: fix possible NULL deref of tunnel.ip6->parms.i_key	2016-08-11 13:15:57 +02:00
xfrm_ipcomp.c	net: xfrm: use preempt-safe this_cpu_read() in ipcomp_alloc_tfms()	2018-04-08 12:12:49 +02:00
xfrm_output.c	xfrm: Reset encapsulation field of the skb before transformation	2016-03-17 10:28:44 +01:00
xfrm_policy.c	xfrm: policy: use hlist rcu variants on insert	2018-11-13 11:16:47 -08:00
xfrm_proc.c	proc: Reduce cache miss in xfrm_statistics_seq_show	2016-09-30 01:50:45 -04:00
xfrm_replay.c	xfrm: constify xfrm_replay structures	2016-08-10 11:18:49 +02:00
xfrm_state.c	xfrm: Fix bucket count reported to userspace	2019-01-13 10:03:48 +01:00
xfrm_sysctl.c	net: xfrm: Change u32 sysctl entries to use proc_douintvec	2016-09-07 23:17:53 -07:00
xfrm_user.c	xfrm: refine validation of template and selector families	2019-02-15 08:07:39 +01:00