Commit 858e5400 authored by Florian Westphal's avatar Florian Westphal Committed by David S. Miller

xfrm: ressurrect "Fix uninitialized memory read in _decode_session4"

This resurrects commit 8742dc86
("xfrm4: Fix uninitialized memory read in _decode_session4"),
which got lost during a merge conflict resolution between ipsec-next
and net-next tree.

c53ac41e ("xfrm: remove decode_session indirection from afinfo_policy")
in ipsec-next moved the (buggy) _decode_session4 from
net/ipv4/xfrm4_policy.c to net/xfrm/xfrm_policy.c.
In mean time, 8742dc86 was applied to ipsec.git and fixed the
problem in the "old" location.

When the trees got merged, the moved, old function was kept.
This applies the "lost" commit again, to the new location.

Fixes: a658a3f2 ("Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next")
Reported-by: default avatarStephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7e27e8d6
...@@ -3264,7 +3264,8 @@ static void ...@@ -3264,7 +3264,8 @@ static void
decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse) decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse)
{ {
const struct iphdr *iph = ip_hdr(skb); const struct iphdr *iph = ip_hdr(skb);
u8 *xprth = skb_network_header(skb) + iph->ihl * 4; int ihl = iph->ihl;
u8 *xprth = skb_network_header(skb) + ihl * 4;
struct flowi4 *fl4 = &fl->u.ip4; struct flowi4 *fl4 = &fl->u.ip4;
int oif = 0; int oif = 0;
...@@ -3275,6 +3276,11 @@ decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse) ...@@ -3275,6 +3276,11 @@ decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse)
fl4->flowi4_mark = skb->mark; fl4->flowi4_mark = skb->mark;
fl4->flowi4_oif = reverse ? skb->skb_iif : oif; fl4->flowi4_oif = reverse ? skb->skb_iif : oif;
fl4->flowi4_proto = iph->protocol;
fl4->daddr = reverse ? iph->saddr : iph->daddr;
fl4->saddr = reverse ? iph->daddr : iph->saddr;
fl4->flowi4_tos = iph->tos;
if (!ip_is_fragment(iph)) { if (!ip_is_fragment(iph)) {
switch (iph->protocol) { switch (iph->protocol) {
case IPPROTO_UDP: case IPPROTO_UDP:
...@@ -3286,7 +3292,7 @@ decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse) ...@@ -3286,7 +3292,7 @@ decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse)
pskb_may_pull(skb, xprth + 4 - skb->data)) { pskb_may_pull(skb, xprth + 4 - skb->data)) {
__be16 *ports; __be16 *ports;
xprth = skb_network_header(skb) + iph->ihl * 4; xprth = skb_network_header(skb) + ihl * 4;
ports = (__be16 *)xprth; ports = (__be16 *)xprth;
fl4->fl4_sport = ports[!!reverse]; fl4->fl4_sport = ports[!!reverse];
...@@ -3298,7 +3304,7 @@ decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse) ...@@ -3298,7 +3304,7 @@ decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse)
pskb_may_pull(skb, xprth + 2 - skb->data)) { pskb_may_pull(skb, xprth + 2 - skb->data)) {
u8 *icmp; u8 *icmp;
xprth = skb_network_header(skb) + iph->ihl * 4; xprth = skb_network_header(skb) + ihl * 4;
icmp = xprth; icmp = xprth;
fl4->fl4_icmp_type = icmp[0]; fl4->fl4_icmp_type = icmp[0];
...@@ -3310,7 +3316,7 @@ decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse) ...@@ -3310,7 +3316,7 @@ decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse)
pskb_may_pull(skb, xprth + 4 - skb->data)) { pskb_may_pull(skb, xprth + 4 - skb->data)) {
__be32 *ehdr; __be32 *ehdr;
xprth = skb_network_header(skb) + iph->ihl * 4; xprth = skb_network_header(skb) + ihl * 4;
ehdr = (__be32 *)xprth; ehdr = (__be32 *)xprth;
fl4->fl4_ipsec_spi = ehdr[0]; fl4->fl4_ipsec_spi = ehdr[0];
...@@ -3321,7 +3327,7 @@ decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse) ...@@ -3321,7 +3327,7 @@ decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse)
pskb_may_pull(skb, xprth + 8 - skb->data)) { pskb_may_pull(skb, xprth + 8 - skb->data)) {
__be32 *ah_hdr; __be32 *ah_hdr;
xprth = skb_network_header(skb) + iph->ihl * 4; xprth = skb_network_header(skb) + ihl * 4;
ah_hdr = (__be32 *)xprth; ah_hdr = (__be32 *)xprth;
fl4->fl4_ipsec_spi = ah_hdr[1]; fl4->fl4_ipsec_spi = ah_hdr[1];
...@@ -3332,7 +3338,7 @@ decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse) ...@@ -3332,7 +3338,7 @@ decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse)
pskb_may_pull(skb, xprth + 4 - skb->data)) { pskb_may_pull(skb, xprth + 4 - skb->data)) {
__be16 *ipcomp_hdr; __be16 *ipcomp_hdr;
xprth = skb_network_header(skb) + iph->ihl * 4; xprth = skb_network_header(skb) + ihl * 4;
ipcomp_hdr = (__be16 *)xprth; ipcomp_hdr = (__be16 *)xprth;
fl4->fl4_ipsec_spi = htonl(ntohs(ipcomp_hdr[1])); fl4->fl4_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
...@@ -3344,7 +3350,7 @@ decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse) ...@@ -3344,7 +3350,7 @@ decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse)
__be16 *greflags; __be16 *greflags;
__be32 *gre_hdr; __be32 *gre_hdr;
xprth = skb_network_header(skb) + iph->ihl * 4; xprth = skb_network_header(skb) + ihl * 4;
greflags = (__be16 *)xprth; greflags = (__be16 *)xprth;
gre_hdr = (__be32 *)xprth; gre_hdr = (__be32 *)xprth;
...@@ -3360,10 +3366,6 @@ decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse) ...@@ -3360,10 +3366,6 @@ decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse)
break; break;
} }
} }
fl4->flowi4_proto = iph->protocol;
fl4->daddr = reverse ? iph->saddr : iph->daddr;
fl4->saddr = reverse ? iph->daddr : iph->saddr;
fl4->flowi4_tos = iph->tos;
} }
#if IS_ENABLED(CONFIG_IPV6) #if IS_ENABLED(CONFIG_IPV6)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment