Sabrina Dubroca 9b3eb54106 xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY ... When CONFIG_XFRM_SUB_POLICY=y, xfrm_dst stores a copy of the flowi for that dst. Unfortunately, the code that allocates and fills this copy doesn't care about what type of flowi (flowi, flowi4, flowi6) gets passed. In multiple code paths (from raw_sendmsg, from TCP when replying to a FIN, in vxlan, geneve, and gre), the flowi that gets passed to xfrm is actually an on-stack flowi4, so we end up reading stuff from the stack past the end of the flowi4 struct. Since xfrm_dst->origin isn't used anywhere following commit ca116922af ("xfrm: Eliminate "fl" and "pol" args to xfrm_bundle_ok()."), just get rid of it. xfrm_dst->partner isn't used either, so get rid of that too. Fixes: 9d6ec93801 ("ipv4: Use flowi4 in public route lookup interfaces.") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>		2017-05-04 07:30:59 +02:00
..
6lowpan	6lowpan: Don't set IFF_NO_QUEUE	2017-04-12 22:02:40 +02:00
9p	net/9p: switch to copy_from_iter_full()	2017-04-21 13:57:22 -04:00
802
8021q	netlink: pass extended ACK struct to parsing functions	2017-04-13 13:58:22 -04:00
appletalk	lib/vsprintf.c: remove %Z support	2017-02-27 18:43:47 -08:00
atm	neighbour: fix nlmsg_pid in notifications	2017-03-22 10:48:49 -07:00
ax25	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
batman-adv	This feature/cleanup patchset includes the following patches:	2017-04-06 14:37:50 -07:00
bluetooth	Bluetooth: Add selftest for ECDH key generation	2017-04-30 16:52:43 +03:00
bpf	bpf: Align packet data properly in program testing framework.	2017-05-02 11:46:28 -04:00
bridge	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2017-05-03 10:11:26 -04:00
caif	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>	2017-03-02 08:42:29 +01:00
can	can: fix CAN BCM build with CONFIG_PROC_FS disabled	2017-04-27 09:34:13 +02:00
ceph	libceph: force GFP_NOIO for socket allocations	2017-03-23 12:03:36 +01:00
core	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-05-02 16:40:27 -07:00
dcb	net: rtnetlink: plumb extended ack to doit function	2017-04-17 15:35:38 -04:00
dccp	dccp: fix memory leak during tear-down of unsuccessful connection request	2017-03-13 22:00:42 -07:00
decnet	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2017-05-01 10:47:53 -04:00
dns_resolver	Merge branch 'WIP.sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-03-03 10:16:38 -08:00
dsa	net: dsa: Remove redundant NULL dst check	2017-04-21 10:41:24 -04:00
ethernet	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2017-02-16 21:25:49 -05:00
hsr	netlink: extended ACK reporting	2017-04-13 13:58:20 -04:00
ieee802154	netlink: pass extended ACK struct where available	2017-04-13 13:58:22 -04:00
ife	net: Introduce ife encapsulation module	2017-02-03 15:16:45 -05:00
ipv4	esp4: Fix udpencap for local TCP packets.	2017-05-04 07:27:26 +02:00
ipv6	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2017-05-03 10:11:26 -04:00
ipx	ipx: call ipxitf_put() in ioctl error path	2017-05-02 15:34:53 -04:00
irda	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
iucv	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
kcm	kcm: remove a useless copy_from_user()	2017-04-17 13:28:48 -04:00
key	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-04-21 20:23:53 -07:00
l2tp	l2tp: remove useless device duplication test in l2tp_eth_create()	2017-04-27 16:32:13 -04:00
l3mdev
lapb
llc	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
mac80211	cfg80211: add request id to cfg80211_sched_scan_*() api	2017-04-28 14:51:43 +02:00
mac802154	drivers: add explicit interrupt.h includes	2017-03-30 11:05:34 -07:00
mpls	net: rtnetlink: plumb extended ack to doit function	2017-04-17 15:35:38 -04:00
ncsi
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2017-05-03 10:11:26 -04:00
netlabel	netlink: pass extended ACK struct to parsing functions	2017-04-13 13:58:22 -04:00
netlink	netlink: pass extended ACK struct where available	2017-04-13 13:58:22 -04:00
netrom	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
nfc	NFC 4.12 pull request	2017-04-21 15:29:40 -04:00
openvswitch	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2017-05-03 10:11:26 -04:00
packet	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-04-26 22:39:08 -04:00
phonet	net: rtnetlink: plumb extended ack to doit function	2017-04-17 15:35:38 -04:00
psample
qrtr	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-04-21 20:23:53 -07:00
rds	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-05-02 16:40:27 -07:00
rfkill
rose	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
rxrpc	rxrpc: Trace client call connection	2017-04-06 11:10:41 +01:00
sched	net: sched: add helpers to handle extended actions	2017-05-02 15:33:54 -04:00
sctp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-05-02 16:40:27 -07:00
smc	net/smc: do not use IB_SEND_INLINE together with mapped data	2017-04-11 23:01:14 -04:00
strparser	strparser: destroy workqueue on module exit	2017-03-03 20:43:26 -08:00
sunrpc	The restriction of NFSv4 to TCP went overboard and also broke the	2017-04-01 10:43:37 -07:00
switchdev	netlink: pass extended ACK struct to parsing functions	2017-04-13 13:58:22 -04:00
tipc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-05-02 16:40:27 -07:00
unix	af_unix: Use designated initializers	2017-04-06 12:43:04 -07:00
vmw_vsock	VSOCK: Add virtio vsock vsockmon hooks	2017-04-24 12:35:56 -04:00
wimax
wireless	cfg80211: add request id to cfg80211_sched_scan_*() api	2017-04-28 14:51:43 +02:00
x25	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
xfrm	xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY	2017-05-04 07:30:59 +02:00
compat.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-02-22 10:15:09 -08:00
Kconfig	bpf: make jited programs visible in traces	2017-02-17 13:40:05 -05:00
Makefile	bpf: introduce BPF_PROG_TEST_RUN command	2017-04-01 12:45:57 -07:00
socket.c	l2tp: device MTU setup, tunnel socket needs a lock	2017-04-17 13:01:48 -04:00
sysctl_net.c