commit c9f3f813d462c72dbe412cee6a5cbacf13c4ad5e
author Steffen Klassert <steffen.klassert@secunet.com> Thu Nov 02 08:10:17 2017 +0100
committer Steffen Klassert <steffen.klassert@secunet.com> Fri Nov 03 13:02:41 2017 +0100
tree 5cf9469a3b411befeb91cfd3f34170b92e2a8356
parent cf37966751747727629fe51fd4a1d4edd8457c60

xfrm: Fix stack-out-of-bounds read in xfrm_state_find.

When we do tunnel or beet mode, we pass saddr and daddr from the
template to xfrm_state_find(), this is ok. On transport mode,
we pass the addresses from the flowi, assuming that the IP
addresses (and address family) don't change during transformation.
This assumption is wrong in the IPv4 mapped IPv6 case, packet
is IPv4 and template is IPv6. Fix this by using the addresses
from the template unconditionally.

Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>