android_kernel_oneplus_msm8998/net/xfrm
Sabrina Dubroca 398ac7a19f xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY
commit 9b3eb54106cf6acd03f07cf0ab01c13676a226c2 upstream.

When CONFIG_XFRM_SUB_POLICY=y, xfrm_dst stores a copy of the flowi for
that dst. Unfortunately, the code that allocates and fills this copy
doesn't care about what type of flowi (flowi, flowi4, flowi6) gets
passed. In multiple code paths (from raw_sendmsg, from TCP when
replying to a FIN, in vxlan, geneve, and gre), the flowi that gets
passed to xfrm is actually an on-stack flowi4, so we end up reading
stuff from the stack past the end of the flowi4 struct.

Since xfrm_dst->origin isn't used anywhere following commit
ca116922af ("xfrm: Eliminate "fl" and "pol" args to
xfrm_bundle_ok()."), just get rid of it.  xfrm_dst->partner isn't used
either, so get rid of that too.

Fixes: 9d6ec93801 ("ipv4: Use flowi4 in public route lookup interfaces.")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-05 14:37:21 +02:00
..
Kconfig
Makefile
xfrm_algo.c ipsec: Replace seqniv with seqiv 2015-08-17 16:53:42 +08:00
xfrm_hash.c
xfrm_hash.h xfrm: hash prefixed policies based on preflen thresholds 2014-09-02 13:29:44 +02:00
xfrm_input.c xfrm: Fix crash observed during device unregistration and decryption 2016-04-20 15:42:05 +09:00
xfrm_ipcomp.c
xfrm_output.c net: preserve IP control block during GSO segmentation 2016-01-31 11:29:00 -08:00
xfrm_policy.c xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY 2017-07-05 14:37:21 +02:00
xfrm_proc.c
xfrm_replay.c xfrm: Always zero high-order sequence number bits 2015-05-21 06:56:23 +02:00
xfrm_state.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-06-01 22:51:30 -07:00
xfrm_sysctl.c
xfrm_user.c xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder 2017-03-31 09:49:52 +02:00