From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Cyrus-Session-Id: sloti22d1t05-1372482-1517179652-2-8894976067529223658 X-Sieve: CMU Sieve 3.0 X-Spam-known-sender: no X-Spam-score: 0.0 X-Spam-hits: BAYES_00 -1.9, HEADER_FROM_DIFFERENT_DOMAINS 0.001, RCVD_IN_DNSWL_HI -5, T_RP_MATCHES_RCVD -0.01, LANGUAGES en, BAYES_USED global, SA_VERSION 3.4.0 X-Spam-source: IP='209.132.180.67', Host='vger.kernel.org', Country='US', FromHeader='com', MailFrom='org', XOriginatingCountry='US' X-Spam-charsets: plain='iso-8859-1' X-Resolved-to: greg@kroah.com X-Delivered-to: greg@kroah.com X-Mail-from: stable-owner@vger.kernel.org ARC-Seal: i=1; a=rsa-sha256; cv=none; d=messagingengine.com; s=arctest; t=1517179652; b=mR1AeSkX8HvHS711btzngNk/UKxqcYnJIsXxAcmH2GbL/3s LJPv7l2NA2/2UVATv/Mt6hrvKhzuqE+qpi+xe5yYyjimSO/R0x3vD+hCt/1wQcC6 zJPq2jYHGF2PSfm/d/PMTpqs6rb07SFHW12noQAFQffe8PnHJeDWA+OWzbeAZpYT uliWgMekk8OKhkh4MfXWjib10RV6OLdxhMypqtM0dyCN10TDY0kBFFoz8LiWHK8u 4ipO/2HwdKByn76/5sKnIoRuO1CA2ll/kb9CtQC2w/dsGbYs0gKQH/U7n4WquHUL bq40GVDZ6Dq7zY8LMH/xyUqpvMyVwDh216pcq6g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=from:to:cc:subject:date:message-id :references:in-reply-to:content-type:content-transfer-encoding :mime-version:sender:list-id; s=arctest; t=1517179652; bh=Y7A2sB zT6WjLf6uUYv9qj0kge/hBCDlFwMsbZfc3krU=; b=IeiZA3zdkVImqsRSVprbY7 +EKwtG76l+5IV2gNv0TwHBAH3LOL1XHdBkELfoIDPFKxKjUYVPM00ruIbrF4OmV9 5y5uXyzYIWbdVb77c8O1fnHQWhY3aajUG7BMXilsaOh3jQVgJuneENN72qX1LQ3P qKYUxBnLAO5DacflJZzZHun1Zl4J2hEi2PqDSLGIc3QfXoSnLNXQfPBvkopiNfb+ OSPWNCcIBcZlzNbHgyF7EQXeKxiN2Do7TVI5alNCQwSkM4C0lmkB1yCUKoC1f6VF 8GzjFNCGaDKAp0snCHAq2uxLpaTsjCN7fZZ2uk/LRw8IkI+MxRLw9kOn8AWtOf+w == ARC-Authentication-Results: i=1; mx1.messagingengine.com; arc=none (no signatures found); dkim=pass (1024-bit rsa key sha256) header.d=microsoft.com header.i=@microsoft.com header.b=m8cWkIh2 x-bits=1024 x-keytype=rsa x-algorithm=sha256 x-selector=selector1; dmarc=pass (p=reject,has-list-id=yes,d=none) header.from=microsoft.com; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=microsoft.com header.result=pass header_is_org_domain=yes Authentication-Results: mx1.messagingengine.com; arc=none (no signatures found); dkim=pass (1024-bit rsa key sha256) header.d=microsoft.com header.i=@microsoft.com header.b=m8cWkIh2 x-bits=1024 x-keytype=rsa x-algorithm=sha256 x-selector=selector1; dmarc=pass (p=reject,has-list-id=yes,d=none) header.from=microsoft.com; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=microsoft.com header.result=pass header_is_org_domain=yes Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932282AbeA1W3P (ORCPT ); Sun, 28 Jan 2018 17:29:15 -0500 Received: from mail-sn1nam01on0139.outbound.protection.outlook.com ([104.47.32.139]:17739 "EHLO NAM01-SN1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S932264AbeA1W3N (ORCPT ); Sun, 28 Jan 2018 17:29:13 -0500 From: Sasha Levin To: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" CC: Steffen Klassert , Sasha Levin Subject: [PATCH AUTOSEL for 4.9 40/49] xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies. Thread-Topic: [PATCH AUTOSEL for 4.9 40/49] xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies. Thread-Index: AQHTmIdBbpd1+sfAaki0M2A06m6qZw== Date: Sun, 28 Jan 2018 22:28:01 +0000 Message-ID: <20180128222727.22404-40-alexander.levin@microsoft.com> References: <20180128222727.22404-1-alexander.levin@microsoft.com> In-Reply-To: <20180128222727.22404-1-alexander.levin@microsoft.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [52.168.54.252] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1;MW2PR2101MB0924;7:1teT4t5u6bI7XDV1rvqEzVEelM6kiOHJSlAancFwRzw7hkWsEZ3ZVnL5cVKEPM1/RpCOBzHOD7DFy+TlfN/LALfpbfbP1/+k20UwAQfUVGl2nGCUujoWVFnm7OtSbAADCzi5CIsduj1sujXjec6iWYc92+KswfKD20j06sWNd3vhIRWA38X0bDxsHsPJOcKcWuK3pxQ+Mbd9FLQIsua3Re9cE9jGEe3AXxe9gXBgAGC5uaKF429dum4pk+eUQyDw x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: d26abdbc-9e74-4328-bd3e-08d5669e8b08 x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(7020095)(4652020)(4534165)(4627221)(201703031133081)(201702281549075)(48565401081)(5600026)(4604075)(3008032)(2017052603307)(7193020);SRVR:MW2PR2101MB0924; x-ms-traffictypediagnostic: MW2PR2101MB0924: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alexander.Levin@microsoft.com; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(278428928389397)(89211679590171); x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(61425038)(6040501)(2401047)(5005006)(8121501046)(93006095)(93001095)(3002001)(10201501046)(3231101)(944501161)(6055026)(61426038)(61427038)(6041288)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123558120)(20161123562045)(20161123560045)(20161123564045)(6072148)(201708071742011);SRVR:MW2PR2101MB0924;BCL:0;PCL:0;RULEID:;SRVR:MW2PR2101MB0924; x-forefront-prvs: 05669A7924 x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(979002)(396003)(346002)(39860400002)(366004)(39380400002)(376002)(189003)(199004)(2906002)(26005)(10090500001)(6116002)(3846002)(59450400001)(8936002)(6666003)(86362001)(36756003)(186003)(66066001)(99286004)(1076002)(107886003)(86612001)(4326008)(25786009)(5250100002)(68736007)(2900100001)(2501003)(72206003)(6512007)(3280700002)(22452003)(53936002)(478600001)(10290500003)(106356001)(3660700001)(110136005)(54906003)(97736004)(6436002)(316002)(2950100002)(8676002)(81156014)(76176011)(81166006)(6506007)(105586002)(305945005)(14454004)(6486002)(102836004)(5660300001)(7736002)(22906009)(217873001)(969003)(989001)(999001)(1009001)(1019001);DIR:OUT;SFP:1102;SCL:1;SRVR:MW2PR2101MB0924;H:MW2PR2101MB1034.namprd21.prod.outlook.com;FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; x-microsoft-antispam-message-info: g95cT3UFbF2Y42TM6Gu6TOWjlyLEeZBbc5pTfQhs4UPK4TfV/j5NvsIBTRKQKTvUZWXWUoz9E4oMxFBwbGxFnA== spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: d26abdbc-9e74-4328-bd3e-08d5669e8b08 X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Jan 2018 22:28:01.8455 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW2PR2101MB0924 Sender: stable-owner@vger.kernel.org X-Mailing-List: stable@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-Mailing-List: linux-kernel@vger.kernel.org List-ID: From: Steffen Klassert [ Upstream commit 732706afe1cc46ef48493b3d2b69c98f36314ae4 ] On policies with a transport mode template, we pass the addresses from the flowi to xfrm_state_find(), assuming that the IP addresses (and address family) don't change during transformation. Unfortunately our policy template validation is not strict enough. It is possible to configure policies with transport mode template where the address family of the template does not match the selectors address family. This lead to stack-out-of-bound reads because we compare arddesses of the wrong family. Fix this by refusing such a configuration, address family can not change on transport mode. We use the assumption that, on transport mode, the first templates address family must match the address family of the policy selector. Subsequent transport mode templates must mach the address family of the previous template. Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin --- net/xfrm/xfrm_user.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 22934885bd3f..37ac96ea4988 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -1380,11 +1380,14 @@ static void copy_templates(struct xfrm_policy *xp, = struct xfrm_user_tmpl *ut, =20 static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family) { + u16 prev_family; int i; =20 if (nr > XFRM_MAX_DEPTH) return -EINVAL; =20 + prev_family =3D family; + for (i =3D 0; i < nr; i++) { /* We never validated the ut->family value, so many * applications simply leave it at zero. The check was @@ -1396,6 +1399,12 @@ static int validate_tmpl(int nr, struct xfrm_user_tm= pl *ut, u16 family) if (!ut[i].family) ut[i].family =3D family; =20 + if ((ut[i].mode =3D=3D XFRM_MODE_TRANSPORT) && + (ut[i].family !=3D prev_family)) + return -EINVAL; + + prev_family =3D ut[i].family; + switch (ut[i].family) { case AF_INET: break; --=20 2.11.0