lkml.org 
[lkml]   [2018]   [Jul]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 18/18] xfrm: Enable compat syscalls
    Date
    Compatible syscalls were disabled for xfrm with the following commits:
    19d7df69fdb2 ("xfrm: Refuse to insert 32 bit userspace socket policies
    on 64 bit systems") and 74005991b78a ("xfrm: Do not parse 32bits
    compiled xfrm netlink msg on 64bits host").

    As some structures in xfrm uapi header were not packed by a mistake,
    they differ in size between 64-bit and 32-bit applications:

    32-bit UABI | 64-bit UABI
    --------------------------------------|--------------------------------------
    sizeof(xfrm_usersa_info) = 220 | sizeof(xfrm_usersa_info) = 224
    sizeof(xfrm_userpolicy_info) = 164 | sizeof(xfrm_userpolicy_info) = 168
    sizeof(xfrm_userspi_info) = 228 | sizeof(xfrm_userspi_info) = 232
    sizeof(xfrm_user_acquire) = 276 | sizeof(xfrm_user_acquire) = 280
    sizeof(xfrm_user_expire) = 224 | sizeof(xfrm_user_expire) = 232
    sizeof(xfrm_user_polexpire) = 168 | sizeof(xfrm_user_polexpire) = 176

    With previous patches compatible layer was added to xfrm, so now we
    support users of both ABI. A selftest to check work of ipsec tunnel is
    present in net/ipsec. It can be easily compiled as compat application
    and doesn't require any compat libraries.

    Revert the mentioned commits and check the size of received message
    according to native/compat syscall.

    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: Fan Du <fan.du@intel.com>
    Cc: Herbert Xu <herbert@gondor.apana.org.au>
    Cc: Steffen Klassert <steffen.klassert@secunet.com>
    Cc: netdev@vger.kernel.org
    Signed-off-by: Dmitry Safonov <dima@arista.com>
    ---
    net/xfrm/xfrm_state.c | 3 ---
    net/xfrm/xfrm_user.c | 35 ++++++++++++++++++++++++++++++-----
    2 files changed, 30 insertions(+), 8 deletions(-)

    diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
    index 3f48a6925606..515a565bfc37 100644
    --- a/net/xfrm/xfrm_state.c
    +++ b/net/xfrm/xfrm_state.c
    @@ -2057,9 +2057,6 @@ int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen
    struct xfrm_mgr *km;
    struct xfrm_policy *pol = NULL;

    - if (in_compat_syscall())
    - return -EOPNOTSUPP;
    -
    if (!optval && !optlen) {
    xfrm_sk_policy_insert(sk, XFRM_POLICY_IN, NULL);
    xfrm_sk_policy_insert(sk, XFRM_POLICY_OUT, NULL);
    diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
    index 7e3a132b76fb..f6da6ea65d37 100644
    --- a/net/xfrm/xfrm_user.c
    +++ b/net/xfrm/xfrm_user.c
    @@ -2634,6 +2634,30 @@ static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
    [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = sizeof(u32),
    };

    +static const int xfrm_msg_min_compat[XFRM_NR_MSGTYPES] = {
    + [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info_packed),
    + [XFRM_MSG_DELSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
    + [XFRM_MSG_GETSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
    + [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info_packed),
    + [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
    + [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
    + [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info_packed),
    + [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire_packed),
    + [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire_packed),
    + [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info_packed),
    + [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info_packed),
    + [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire_packed),
    + [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush),
    + [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0,
    + [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
    + [XFRM_MSG_GETAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
    + [XFRM_MSG_REPORT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report),
    + [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
    + [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = sizeof(u32),
    + [XFRM_MSG_NEWSPDINFO - XFRM_MSG_BASE] = sizeof(u32),
    + [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = sizeof(u32),
    +};
    +
    #undef XMSGSIZE

    static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
    @@ -2715,10 +2739,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
    struct net *net = sock_net(skb->sk);
    struct nlattr *attrs[XFRMA_MAX+1];
    const struct xfrm_link *link;
    - int type, err;
    -
    - if (in_compat_syscall())
    - return -EOPNOTSUPP;
    + int type, err, hdrlen;

    type = nlh->nlmsg_type;
    if (type > XFRM_MSG_MAX)
    @@ -2747,7 +2768,11 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
    }
    }

    - err = nlmsg_parse(nlh, xfrm_msg_min[type], attrs,
    + hdrlen = xfrm_msg_min[type];
    + if (in_compat_syscall())
    + hdrlen = xfrm_msg_min_compat[type];
    +
    + err = nlmsg_parse(nlh, hdrlen, attrs,
    link->nla_max ? : XFRMA_MAX,
    link->nla_pol ? : xfrma_policy, extack);
    if (err < 0)
    --
    2.13.6
    \
     
     \ /
      Last update: 2018-07-26 04:34    [W:3.129 / U:0.512 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site