Eric Lee / smarc-ti-linux-kernel

Download as
Browse Code ยป

Commit 0b8656414e29578f00e40e7d19c411039b9ab71e

Authored by Steffen Klassert
Committed by Greg Kroah-Hartman
1 parent ab5e7df9e0
Exists in smarct4x-processor-sdk-04.01.00.06 and in 1 other branch smarct3x-processor-sdk-04.01.00.06

xfrm: Don't use sk_family for socket policy lookups 

commit 4c86d77743a54fb2d8a4d18a037a074c892bb3be upstream.

On IPv4-mapped IPv6 addresses sk_family is AF_INET6,
but the flow informations are created based on AF_INET.
So the routing set up 'struct flowi4' but we try to
access 'struct flowi6' what leads to an out of bounds
access. Fix this by using the family we get with the
dst_entry, like we do it for the standard policy lookup.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Showing 1 changed file with 4 additions and 5 deletions Side-by-side Diff

net/xfrm/xfrm_policy.c
Diff comments   View file @ 0b86564
... ... @@ -1248,7 +1248,7 @@
1248 1248 }
1249 1249  
1250 1250 static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
1251   - const struct flowi *fl)
  1251 + const struct flowi *fl, u16 family)
1252 1252 {
1253 1253 struct xfrm_policy *pol;
1254 1254  
... ... @@ -1256,8 +1256,7 @@
1256 1256 again:
1257 1257 pol = rcu_dereference(sk->sk_policy[dir]);
1258 1258 if (pol != NULL) {
1259   - bool match = xfrm_selector_match(&pol->selector, fl,
1260   - sk->sk_family);
  1259 + bool match = xfrm_selector_match(&pol->selector, fl, family);
1261 1260 int err = 0;
1262 1261  
1263 1262 if (match) {
... ... @@ -2206,7 +2205,7 @@
2206 2205 sk = sk_const_to_full_sk(sk);
2207 2206 if (sk && sk->sk_policy[XFRM_POLICY_OUT]) {
2208 2207 num_pols = 1;
2209   - pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
  2208 + pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl, family);
2210 2209 err = xfrm_expand_policies(fl, family, pols,
2211 2210 &num_pols, &num_xfrms);
2212 2211 if (err < 0)
... ... @@ -2485,7 +2484,7 @@
2485 2484 pol = NULL;
2486 2485 sk = sk_to_full_sk(sk);
2487 2486 if (sk && sk->sk_policy[dir]) {
2488   - pol = xfrm_sk_policy_lookup(sk, dir, &fl);
  2487 + pol = xfrm_sk_policy_lookup(sk, dir, &fl, family);
2489 2488 if (IS_ERR(pol)) {
2490 2489 XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR);
2491 2490 return 0;