xfrm: Fix stack-out-of-bounds read in xfrm_state_find.

When we do tunnel or beet mode, we pass saddr and daddr from the
template to xfrm_state_find(), this is ok. On transport mode,
we pass the addresses from the flowi, assuming that the IP
addresses (and address family) don't change during transformation.
This assumption is wrong in the IPv4 mapped IPv6 case, packet
is IPv4 and template is IPv6. Fix this by using the addresses
from the template unconditionally.

Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index a2e531bf4f97630850f2240fb352ff1445843104..6eb228a70131069b74663d72c415daf83e83871b 100644 (file)
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1361,36 +1361,29 @@ xfrm_tmpl_resolve_one(struct xfrm_policy *policy, const struct flowi *fl,
        struct net *net = xp_net(policy);
        int nx;
        int i, error;
-       xfrm_address_t *daddr = xfrm_flowi_daddr(fl, family);
-       xfrm_address_t *saddr = xfrm_flowi_saddr(fl, family);
        xfrm_address_t tmp;
 
        for (nx = 0, i = 0; i < policy->xfrm_nr; i++) {
                struct xfrm_state *x;
-               xfrm_address_t *remote = daddr;
-               xfrm_address_t *local  = saddr;
+               xfrm_address_t *local;
+               xfrm_address_t *remote;
                struct xfrm_tmpl *tmpl = &policy->xfrm_vec[i];
 
-               if (tmpl->mode == XFRM_MODE_TUNNEL ||
-                   tmpl->mode == XFRM_MODE_BEET) {
-                       remote = &tmpl->id.daddr;
-                       local = &tmpl->saddr;
-                       if (xfrm_addr_any(local, tmpl->encap_family)) {
-                               error = xfrm_get_saddr(net, fl->flowi_oif,
-                                                      &tmp, remote,
-                                                      tmpl->encap_family, 0);
-                               if (error)
-                                       goto fail;
-                               local = &tmp;
-                       }
+               remote = &tmpl->id.daddr;
+               local = &tmpl->saddr;
+               if (xfrm_addr_any(local, tmpl->encap_family)) {
+                       error = xfrm_get_saddr(net, fl->flowi_oif,
+                                              &tmp, remote,
+                                              tmpl->encap_family, 0);
+                       if (error)
+                               goto fail;
+                       local = &tmp;
                }
 
                x = xfrm_state_find(remote, local, fl, tmpl, policy, &error, family);
 
                if (x && x->km.state == XFRM_STATE_VALID) {
                        xfrm[nx++] = x;
-                       daddr = remote;
-                       saddr = local;
                        continue;
                }
                if (x) {