Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 94c115d1 authored by Leon Romanovsky's avatar Leon Romanovsky Committed by Greg Kroah-Hartman
Browse files

xfrm: enforce validity of offload input flags 



commit 7c76ecd9c99b6e9a771d813ab1aa7fa428b3ade1 upstream.

struct xfrm_user_offload has flags variable that received user input,
but kernel didn't check if valid bits were provided. It caused a situation
where not sanitized input was forwarded directly to the drivers.

For example, XFRM_OFFLOAD_IPV6 define that was exposed, was used by
strongswan, but not implemented in the kernel at all.

As a solution, check and sanitize input flags to forward
XFRM_OFFLOAD_INBOUND to the drivers.

Fixes: d77e38e6 ("xfrm: Add an IPsec hardware offloading API")
Signed-off-by: default avatarLeon Romanovsky <leonro@nvidia.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 33c4a430

include/uapi/linux/xfrm.h

+6 −0
Original line number Diff line number Diff line
@@ -504,6 +504,12 @@ struct xfrm_user_offload { 
	int				ifindex;

	__u8				flags;

};

/* This flag was exposed without any kernel code that supporting it.

 * Unfortunately, strongswan has the code that uses sets this flag,

 * which makes impossible to reuse this bit.

 *

 * So leave it here to make sure that it won't be reused by mistake.

 */

#define XFRM_OFFLOAD_IPV6	1

#define XFRM_OFFLOAD_INBOUND	2

net/xfrm/xfrm_device.c

+5 −1
Original line number Diff line number Diff line
@@ -153,6 +153,9 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, 
	if (x->encap || x->tfcpad)

		return -EINVAL;



	if (xuo->flags & ~(XFRM_OFFLOAD_IPV6 | XFRM_OFFLOAD_INBOUND))

		return -EINVAL;



	dev = dev_get_by_index(net, xuo->ifindex);

	if (!dev) {

		if (!(xuo->flags & XFRM_OFFLOAD_INBOUND)) {
@@ -190,7 +193,8 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, 


	xso->dev = dev;

	xso->num_exthdrs = 1;

	xso->flags = xuo->flags;

	/* Don't forward bit that is not implemented */

	xso->flags = xuo->flags & ~XFRM_OFFLOAD_IPV6;



	err = dev->xfrmdev_ops->xdo_dev_state_add(x);

	if (err) {