Re: [PATCH v2 net] xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY

2017-05-04 Thread Steffen Klassert
On Wed, May 03, 2017 at 04:43:19PM +0200, Sabrina Dubroca wrote: > When CONFIG_XFRM_SUB_POLICY=y, xfrm_dst stores a copy of the flowi for > that dst. Unfortunately, the code that allocates and fills this copy > doesn't care about what type of flowi (flowi, flowi4, flowi6) gets > passed. In

[PATCH v2 net] xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY

2017-05-03 Thread Sabrina Dubroca
When CONFIG_XFRM_SUB_POLICY=y, xfrm_dst stores a copy of the flowi for that dst. Unfortunately, the code that allocates and fills this copy doesn't care about what type of flowi (flowi, flowi4, flowi6) gets passed. In multiple code paths (from raw_sendmsg, from TCP when replying to a FIN, in