提交 c9f3f813 编写于 作者: S Steffen Klassert

xfrm: Fix stack-out-of-bounds read in xfrm_state_find.

When we do tunnel or beet mode, we pass saddr and daddr from the
template to xfrm_state_find(), this is ok. On transport mode,
we pass the addresses from the flowi, assuming that the IP
addresses (and address family) don't change during transformation.
This assumption is wrong in the IPv4 mapped IPv6 case, packet
is IPv4 and template is IPv6. Fix this by using the addresses
from the template unconditionally.
Signed-off-by: NSteffen Klassert <steffen.klassert@secunet.com>
上级 cf379667
...@@ -1361,36 +1361,29 @@ xfrm_tmpl_resolve_one(struct xfrm_policy *policy, const struct flowi *fl, ...@@ -1361,36 +1361,29 @@ xfrm_tmpl_resolve_one(struct xfrm_policy *policy, const struct flowi *fl,
struct net *net = xp_net(policy); struct net *net = xp_net(policy);
int nx; int nx;
int i, error; int i, error;
xfrm_address_t *daddr = xfrm_flowi_daddr(fl, family);
xfrm_address_t *saddr = xfrm_flowi_saddr(fl, family);
xfrm_address_t tmp; xfrm_address_t tmp;
for (nx = 0, i = 0; i < policy->xfrm_nr; i++) { for (nx = 0, i = 0; i < policy->xfrm_nr; i++) {
struct xfrm_state *x; struct xfrm_state *x;
xfrm_address_t *remote = daddr; xfrm_address_t *local;
xfrm_address_t *local = saddr; xfrm_address_t *remote;
struct xfrm_tmpl *tmpl = &policy->xfrm_vec[i]; struct xfrm_tmpl *tmpl = &policy->xfrm_vec[i];
if (tmpl->mode == XFRM_MODE_TUNNEL || remote = &tmpl->id.daddr;
tmpl->mode == XFRM_MODE_BEET) { local = &tmpl->saddr;
remote = &tmpl->id.daddr; if (xfrm_addr_any(local, tmpl->encap_family)) {
local = &tmpl->saddr; error = xfrm_get_saddr(net, fl->flowi_oif,
if (xfrm_addr_any(local, tmpl->encap_family)) { &tmp, remote,
error = xfrm_get_saddr(net, fl->flowi_oif, tmpl->encap_family, 0);
&tmp, remote, if (error)
tmpl->encap_family, 0); goto fail;
if (error) local = &tmp;
goto fail;
local = &tmp;
}
} }
x = xfrm_state_find(remote, local, fl, tmpl, policy, &error, family); x = xfrm_state_find(remote, local, fl, tmpl, policy, &error, family);
if (x && x->km.state == XFRM_STATE_VALID) { if (x && x->km.state == XFRM_STATE_VALID) {
xfrm[nx++] = x; xfrm[nx++] = x;
daddr = remote;
saddr = local;
continue; continue;
} }
if (x) { if (x) {
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册