in_pcb_lport_dest() uses the inp vflag to determine whether the caller
passed in a v4 or a v6 address. This breaks in the face of v4-mapped
IPv6 addresses, wherein the caller will pass a v4 address. In
particular, the test
(inp->inp_vflag & (INP_IPV4 | INP_IPV6)) == INP_IPV4 fails in this case,
and we end up treating a sockaddr_in as a sockaddr_in6.
Instead, use the sockaddr family to determine what to do, assuming that
the caller has done any required checking (e.g., checking that
IN6P_IPV6_V6ONLY is unset). We can assume that the local and foreign
addresses are from the same family.
Reported by: syzbot+c8e3dac881bba85bc029@syzkaller.appspotmail.com
Reported by: syzbot+81ccc423a2737ed031ac@syzkaller.appspotmail.com