Skip to contentSkip to conversation

Patch "xfrm: Don't use sk_family for socket policy lookups" has been added to the 3.18-stable tree

PATCH [email protected] 1 participant 1 message Aug 4, 2017

Subsystems (3)
Networking Stable branch Networking IPsec
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

xfrm: Don't use sk_family for socket policy lookups

to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
xfrm-don-t-use-sk_family-for-socket-policy-lookups.patch
and it can be found in the queue-3.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 4c86d77743a54fb2d8a4d18a037a074c892bb3be Mon Sep 17 00:00:00 2001

From: Steffen Klassert <[email protected]>
Date: Tue, 14 Feb 2017 07:43:56 +0100
Subject: xfrm: Don't use sk_family for socket policy lookups

From: Steffen Klassert <[email protected]>

commit 4c86d77743a54fb2d8a4d18a037a074c892bb3be upstream.

On IPv4-mapped IPv6 addresses sk_family is AF_INET6, but the flow informations are created based on AF_INET. So the routing set up 'struct flowi4' but we try to access 'struct flowi6' what leads to an out of bounds access. Fix this by using the family we get with the dst_entry, like we do it for the standard policy lookup.

Reported-by Dmitry Vyukov <[email protected]>
Tested-by Dmitry Vyukov <[email protected]>
Signed-off-by Steffen Klassert <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 net/xfrm/xfrm_policy.c |    9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)
net/xfrm/xfrm_policy.c +4 -5
@@ -1211,15 +1211,14 @@ static inline int policy_to_flow_dir(int
 }
 
 static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir,
-						 const struct flowi *fl)
+						 const struct flowi *fl, u16 family)
 {
 	struct xfrm_policy *pol;
 	struct net *net = sock_net(sk);
 
 	read_lock_bh(&net->xfrm.xfrm_policy_lock);
 	if ((pol = sk->sk_policy[dir]) != NULL) {
-		bool match = xfrm_selector_match(&pol->selector, fl,
-						 sk->sk_family);
+		bool match = xfrm_selector_match(&pol->selector, fl, family);
 		int err = 0;
 
 		if (match) {

@@ -2150,7 +2149,7 @@ struct dst_entry *xfrm_lookup(struct net
 
 	if (sk && sk->sk_policy[XFRM_POLICY_OUT]) {
 		num_pols = 1;
-		pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
+		pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl, family);
 		err = xfrm_expand_policies(fl, family, pols,
 					   &num_pols, &num_xfrms);
 		if (err < 0)

@@ -2428,7 +2427,7 @@ int __xfrm_policy_check(struct sock *sk,
 
 	pol = NULL;
 	if (sk && sk->sk_policy[dir]) {
-		pol = xfrm_sk_policy_lookup(sk, dir, &fl);
+		pol = xfrm_sk_policy_lookup(sk, dir, &fl, family);
 		if (IS_ERR(pol)) {
 			XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR);
 			return 0;

Patches currently in stable-queue which might be from [email protected] are

queue-3.18/xfrm-don-t-use-sk_family-for-socket-policy-lookups.patch queue-3.18/af_key-add-lock-to-key-dump.patch