• Sabrina Dubroca's avatar
    xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY · 9b3eb541
    Sabrina Dubroca authored
    When CONFIG_XFRM_SUB_POLICY=y, xfrm_dst stores a copy of the flowi for
    that dst. Unfortunately, the code that allocates and fills this copy
    doesn't care about what type of flowi (flowi, flowi4, flowi6) gets
    passed. In multiple code paths (from raw_sendmsg, from TCP when
    replying to a FIN, in vxlan, geneve, and gre), the flowi that gets
    passed to xfrm is actually an on-stack flowi4, so we end up reading
    stuff from the stack past the end of the flowi4 struct.
    
    Since xfrm_dst->origin isn't used anywhere following commit
    ca116922 ("xfrm: Eliminate "fl" and "pol" args to
    xfrm_bundle_ok()."), just get rid of it.  xfrm_dst->partner isn't used
    either, so get rid of that too.
    
    Fixes: 9d6ec938 ("ipv4: Use flowi4 in public route lookup interfaces.")
    Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
    Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
    9b3eb541
xfrm_policy.c 79.5 KB