Sabrina Dubroca 9b3eb54106 xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY ... When CONFIG_XFRM_SUB_POLICY=y, xfrm_dst stores a copy of the flowi for that dst. Unfortunately, the code that allocates and fills this copy doesn't care about what type of flowi (flowi, flowi4, flowi6) gets passed. In multiple code paths (from raw_sendmsg, from TCP when replying to a FIN, in vxlan, geneve, and gre), the flowi that gets passed to xfrm is actually an on-stack flowi4, so we end up reading stuff from the stack past the end of the flowi4 struct. Since xfrm_dst->origin isn't used anywhere following commit ca116922af ("xfrm: Eliminate "fl" and "pol" args to xfrm_bundle_ok()."), just get rid of it. xfrm_dst->partner isn't used either, so get rid of that too. Fixes: 9d6ec93801 ("ipv4: Use flowi4 in public route lookup interfaces.") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>		2017-05-04 07:30:59 +02:00
..
Kconfig	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2017-02-16 21:25:49 -05:00
Makefile	xfrm: Add an IPsec hardware offloading API	2017-04-14 10:06:10 +02:00
xfrm_algo.c	xfrm: use IS_ENABLED() instead of checking for built-in or module	2016-09-10 21:19:11 -07:00
xfrm_device.c	net: Add a xfrm validate function to validate_xmit_skb	2017-04-14 10:07:28 +02:00
xfrm_hash.c
xfrm_hash.h	xfrm: use "unsigned int" in __xfrm6_pref_hash()	2017-03-24 07:03:12 +01:00
xfrm_input.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-05-02 16:40:27 -07:00
xfrm_ipcomp.c
xfrm_output.c	xfrm: Add encapsulation header offsets while SKB is not encrypted	2017-04-14 10:07:39 +02:00
xfrm_policy.c	xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY	2017-05-04 07:30:59 +02:00
xfrm_proc.c	proc: Reduce cache miss in xfrm_statistics_seq_show	2016-09-30 01:50:45 -04:00
xfrm_replay.c	xfrm: Add xfrm_replay_overflow functions for offloading	2017-04-14 10:07:01 +02:00
xfrm_state.c	xfrm: Add an IPsec hardware offloading API	2017-04-14 10:06:10 +02:00
xfrm_sysctl.c	net: xfrm: Change u32 sysctl entries to use proc_douintvec	2016-09-07 23:17:53 -07:00
xfrm_user.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-05-02 16:40:27 -07:00