• Herbert Xu's avatar
    xfrm: Use correct address family in xfrm_state_find · e94ee171
    Herbert Xu authored
    The struct flowi must never be interpreted by itself as its size
    depends on the address family.  Therefore it must always be grouped
    with its original family value.
    
    In this particular instance, the original family value is lost in
    the function xfrm_state_find.  Therefore we get a bogus read when
    it's coupled with the wrong family which would occur with inter-
    family xfrm states.
    
    This patch fixes it by keeping the original family value.
    
    Note that the same bug could potentially occur in LSM through
    the xfrm_state_pol_flow_match hook.  I checked the current code
    there and it seems to be safe for now as only secid is used which
    is part of struct flowi_common.  But that API should be changed
    so that so that we don't get new bugs in the future.  We could
    do that by replacing fl with just secid or adding a family field.
    
    Reported-by: syzbot+577fbac3145a6eb2e7a5@syzkaller.appspotmail.com
    Fixes: 48b8d783 ("[XFRM]: State selection update to use inner...")
    Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
    e94ee171
xfrm_state.c 65 KB