• Florian Westphal's avatar
    xfrm: refine validation of template and selector families · f46373e0
    Florian Westphal authored
    commit 35e61038 upstream.
    
    The check assumes that in transport mode, the first templates family
    must match the address family of the policy selector.
    
    Syzkaller managed to build a template using MODE_ROUTEOPTIMIZATION,
    with ipv4-in-ipv6 chain, leading to following splat:
    
    BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x1db/0x1854
    Read of size 4 at addr ffff888063e57aa0 by task a.out/2050
     xfrm_state_find+0x1db/0x1854
     xfrm_tmpl_resolve+0x100/0x1d0
     xfrm_resolve_and_create_bundle+0x108/0x1000 [..]
    
    Problem is that addresses point into flowi4 struct, but xfrm_state_find
    treats them as being ipv6 because it uses templ->encap_family is used
    (AF_INET6 in case of reproducer) rather than family (AF_INET).
    
    This patch inverts the logic: Enforce 'template family must match
    selector' EXCEPT for tunnel and BEET mode.
    
    In BEET and Tunnel mode, xfrm_tmpl_resolve_one will have remote/local
    address pointers changed to point at the addresses found in the template,
    rather than the flowi ones, so no oob read will occur.
    
    Reported-by: 3ntr0py1337@gmail.com
    Reported-by: 's avatarDaniel Borkmann <daniel@iogearbox.net>
    Signed-off-by: 's avatarFlorian Westphal <fw@strlen.de>
    Signed-off-by: 's avatarSteffen Klassert <steffen.klassert@secunet.com>
    Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    f46373e0
Name
Last commit
Last update
..
Kconfig Loading commit data...
Makefile Loading commit data...
xfrm_algo.c Loading commit data...
xfrm_device.c Loading commit data...
xfrm_hash.c Loading commit data...
xfrm_hash.h Loading commit data...
xfrm_input.c Loading commit data...
xfrm_interface.c Loading commit data...
xfrm_ipcomp.c Loading commit data...
xfrm_output.c Loading commit data...
xfrm_policy.c Loading commit data...
xfrm_proc.c Loading commit data...
xfrm_replay.c Loading commit data...
xfrm_state.c Loading commit data...
xfrm_sysctl.c Loading commit data...
xfrm_user.c Loading commit data...