Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0c8d2d95 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec 



Steffen Klassert says:

====================
pull request (net): ipsec 2017-08-21

1) Fix memleaks when ESP takes an error path.

2) Fix null pointer dereference when creating a sub policy
   that matches the same outer flow as main policy does.
   From Koichiro Den.

3) Fix possible out-of-bound access in xfrm_migrate.
   This patch should go to the stable trees too.
   From Vladis Dronov.

4) ESP can return positive and negative error values,
   so treat both cases as an error.

Please pull or let me know if there are problems.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 3de33e1b 4ff0308f

net/ipv4/esp4.c

+8 −5
Original line number Diff line number Diff line
@@ -381,7 +381,7 @@ int esp_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info * 
		           (unsigned char *)esph - skb->data,

		           assoclen + ivlen + esp->clen + alen);

	if (unlikely(err < 0))

		goto error;

		goto error_free;



	if (!esp->inplace) {

		int allocsize;
@@ -392,7 +392,7 @@ int esp_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info * 
		spin_lock_bh(&x->lock);

		if (unlikely(!skb_page_frag_refill(allocsize, pfrag, GFP_ATOMIC))) {

			spin_unlock_bh(&x->lock);

			goto error;

			goto error_free;

		}



		skb_shinfo(skb)->nr_frags = 1;
@@ -409,7 +409,7 @@ int esp_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info * 
			           (unsigned char *)esph - skb->data,

			           assoclen + ivlen + esp->clen + alen);

		if (unlikely(err < 0))

			goto error;

			goto error_free;

	}



	if ((x->props.flags & XFRM_STATE_ESN))
@@ -442,8 +442,9 @@ int esp_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info * 


	if (sg != dsg)

		esp_ssg_unref(x, tmp);

	kfree(tmp);



error_free:

	kfree(tmp);

error:

	return err;

}
@@ -695,8 +696,10 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb) 


	sg_init_table(sg, nfrags);

	err = skb_to_sgvec(skb, sg, 0, skb->len);

	if (unlikely(err < 0))

	if (unlikely(err < 0)) {

		kfree(tmp);

		goto out;

	}



	skb->ip_summed = CHECKSUM_NONE;

net/ipv4/esp4_offload.c

+1 −1
Original line number Diff line number Diff line
@@ -257,7 +257,7 @@ static int esp_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features_ 
	esp.seqno = cpu_to_be64(xo->seq.low + ((u64)xo->seq.hi << 32));



	err = esp_output_tail(x, skb, &esp);

	if (err < 0)

	if (err)

		return err;



	secpath_reset(skb);

net/ipv6/esp6.c

+5 −4
Original line number Diff line number Diff line
@@ -345,7 +345,7 @@ int esp6_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info 
		           (unsigned char *)esph - skb->data,

		           assoclen + ivlen + esp->clen + alen);

	if (unlikely(err < 0))

		goto error;

		goto error_free;



	if (!esp->inplace) {

		int allocsize;
@@ -356,7 +356,7 @@ int esp6_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info 
		spin_lock_bh(&x->lock);

		if (unlikely(!skb_page_frag_refill(allocsize, pfrag, GFP_ATOMIC))) {

			spin_unlock_bh(&x->lock);

			goto error;

			goto error_free;

		}



		skb_shinfo(skb)->nr_frags = 1;
@@ -373,7 +373,7 @@ int esp6_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info 
			           (unsigned char *)esph - skb->data,

			           assoclen + ivlen + esp->clen + alen);

		if (unlikely(err < 0))

			goto error;

			goto error_free;

	}



	if ((x->props.flags & XFRM_STATE_ESN))
@@ -406,8 +406,9 @@ int esp6_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info 


	if (sg != dsg)

		esp_ssg_unref(x, tmp);

	kfree(tmp);



error_free:

	kfree(tmp);

error:

	return err;

}

net/ipv6/esp6_offload.c

+1 −1
Original line number Diff line number Diff line
@@ -286,7 +286,7 @@ static int esp6_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features 
	esp.seqno = cpu_to_be64(xo->seq.low + ((u64)xo->seq.hi << 32));



	err = esp6_output_tail(x, skb, &esp);

	if (err < 0)

	if (err)

		return err;



	secpath_reset(skb);

net/xfrm/xfrm_policy.c

+6 −0
Original line number Diff line number Diff line
@@ -3308,9 +3308,15 @@ int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 
	struct xfrm_state *x_new[XFRM_MAX_DEPTH];

	struct xfrm_migrate *mp;



	/* Stage 0 - sanity checks */

	if ((err = xfrm_migrate_check(m, num_migrate)) < 0)

		goto out;



	if (dir >= XFRM_POLICY_MAX) {

		err = -EINVAL;

		goto out;

	}



	/* Stage 1 - find policy */

	if ((pol = xfrm_migrate_policy_find(sel, dir, type, net)) == NULL) {

		err = -ENOENT;