Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 13ab504b authored by Dmitry Safonov's avatar Dmitry Safonov Committed by Connor O'Brien
Browse files

UPSTREAM: xfrm/compat: Cleanup WARN()s that can be user-triggered 



Replace WARN_ONCE() that can be triggered from userspace with
pr_warn_once(). Those still give user a hint what's the issue.

I've left WARN()s that are not possible to trigger with current
code-base and that would mean that the code has issues:
- relying on current compat_msg_min[type] <= xfrm_msg_min[type]
- expected 4-byte padding size difference between
  compat_msg_min[type] and xfrm_msg_min[type]
- compat_policy[type].len <= xfrma_policy[type].len
(for every type)

Reported-by: default avatar <syzbot+834ffd1afc7212eb8147@syzkaller.appspotmail.com>
Fixes: 5f3eea6b7e8f ("xfrm/compat: Attach xfrm dumps to 64=>32 bit translator")
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: netdev@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDmitry Safonov <dima@arista.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
(cherry picked from commit ef19e111337f6c3dca7019a8bad5fbc6fb18d635)
Bug: 187129171
Signed-off-by: default avatarConnor O'Brien <connoro@google.com>
Change-Id: I9576dc6fd1be792674b2e4e844769b8b7659c151
parent 236d4169

net/xfrm/xfrm_compat.c

+9 −3
Original line number Diff line number Diff line
@@ -216,7 +216,7 @@ static struct nlmsghdr *xfrm_nlmsg_put_compat(struct sk_buff *skb, 
	case XFRM_MSG_GETSADINFO:

	case XFRM_MSG_GETSPDINFO:

	default:

		WARN_ONCE(1, "unsupported nlmsg_type %d", nlh_src->nlmsg_type);

		pr_warn_once("unsupported nlmsg_type %d\n", nlh_src->nlmsg_type);

		return ERR_PTR(-EOPNOTSUPP);

	}
@@ -277,7 +277,7 @@ static int xfrm_xlate64_attr(struct sk_buff *dst, const struct nlattr *src) 
		return xfrm_nla_cpy(dst, src, nla_len(src));

	default:

		BUILD_BUG_ON(XFRMA_MAX != XFRMA_IF_ID);

		WARN_ONCE(1, "unsupported nla_type %d", src->nla_type);

		pr_warn_once("unsupported nla_type %d\n", src->nla_type);

		return -EOPNOTSUPP;

	}

}
@@ -315,8 +315,10 @@ static int xfrm_alloc_compat(struct sk_buff *skb, const struct nlmsghdr *nlh_src 
	struct sk_buff *new = NULL;

	int err;



	if (WARN_ON_ONCE(type >= ARRAY_SIZE(xfrm_msg_min)))

	if (type >= ARRAY_SIZE(xfrm_msg_min)) {

		pr_warn_once("unsupported nlmsg_type %d\n", nlh_src->nlmsg_type);

		return -EOPNOTSUPP;

	}



	if (skb_shinfo(skb)->frag_list == NULL) {

		new = alloc_skb(skb->len + skb_tailroom(skb), GFP_ATOMIC);
@@ -378,6 +380,10 @@ static int xfrm_attr_cpy32(void *dst, size_t *pos, const struct nlattr *src, 
	struct nlmsghdr *nlmsg = dst;

	struct nlattr *nla;



	/* xfrm_user_rcv_msg_compat() relies on fact that 32-bit messages

	 * have the same len or shorted than 64-bit ones.

	 * 32-bit translation that is bigger than 64-bit original is unexpected.

	 */

	if (WARN_ON_ONCE(copy_len > payload))

		copy_len = payload;