Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 94802151 authored by Steffen Klassert's avatar Steffen Klassert
Browse files

Revert "xfrm: Fix stack-out-of-bounds read in xfrm_state_find." 



This reverts commit c9f3f813.

This commit breaks transport mode when the policy template
has widlcard addresses configured, so revert it.

Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent 0e74aa1d

net/xfrm/xfrm_policy.c

+18 −11
Original line number Diff line number Diff line
@@ -1362,14 +1362,18 @@ xfrm_tmpl_resolve_one(struct xfrm_policy *policy, const struct flowi *fl, 
	struct net *net = xp_net(policy);

	int nx;

	int i, error;

	xfrm_address_t *daddr = xfrm_flowi_daddr(fl, family);

	xfrm_address_t *saddr = xfrm_flowi_saddr(fl, family);

	xfrm_address_t tmp;



	for (nx = 0, i = 0; i < policy->xfrm_nr; i++) {

		struct xfrm_state *x;

		xfrm_address_t *local;

		xfrm_address_t *remote;

		xfrm_address_t *remote = daddr;

		xfrm_address_t *local  = saddr;

		struct xfrm_tmpl *tmpl = &policy->xfrm_vec[i];



		if (tmpl->mode == XFRM_MODE_TUNNEL ||

		    tmpl->mode == XFRM_MODE_BEET) {

			remote = &tmpl->id.daddr;

			local = &tmpl->saddr;

			if (xfrm_addr_any(local, tmpl->encap_family)) {
@@ -1380,11 +1384,14 @@ xfrm_tmpl_resolve_one(struct xfrm_policy *policy, const struct flowi *fl, 
					goto fail;

				local = &tmp;

			}

		}



		x = xfrm_state_find(remote, local, fl, tmpl, policy, &error, family);



		if (x && x->km.state == XFRM_STATE_VALID) {

			xfrm[nx++] = x;

			daddr = remote;

			saddr = local;

			continue;

		}

		if (x) {