Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 661697f728d75302e1f661a58db2fcba71d5cbc9

Authored by Joy Latten
Committed by David S. Miller
1 parent 279e172a58
Exists in master and in 7 other branches imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

[IPSEC] XFRM_USER: kernel panic when large security contexts in ACQUIRE 

When sending a security context of 50+ characters in an ACQUIRE
message, following kernel panic occurred.

kernel BUG in xfrm_send_acquire at net/xfrm/xfrm_user.c:1781!
cpu 0x3: Vector: 700 (Program Check) at [c0000000421bb2e0]
    pc: c00000000033b074: .xfrm_send_acquire+0x240/0x2c8
    lr: c00000000033b014: .xfrm_send_acquire+0x1e0/0x2c8
    sp: c0000000421bb560
   msr: 8000000000029032
  current = 0xc00000000fce8f00
  paca    = 0xc000000000464b00
    pid   = 2303, comm = ping
kernel BUG in xfrm_send_acquire at net/xfrm/xfrm_user.c:1781!
enter ? for help
3:mon> t
[c0000000421bb650] c00000000033538c .km_query+0x6c/0xec
[c0000000421bb6f0] c000000000337374 .xfrm_state_find+0x7f4/0xb88
[c0000000421bb7f0] c000000000332350 .xfrm_tmpl_resolve+0xc4/0x21c
[c0000000421bb8d0] c0000000003326e8 .xfrm_lookup+0x1a0/0x5b0
[c0000000421bba00] c0000000002e6ea0 .ip_route_output_flow+0x88/0xb4
[c0000000421bbaa0] c0000000003106d8 .ip4_datagram_connect+0x218/0x374
[c0000000421bbbd0] c00000000031bc00 .inet_dgram_connect+0xac/0xd4
[c0000000421bbc60] c0000000002b11ac .sys_connect+0xd8/0x120
[c0000000421bbd90] c0000000002d38d0 .compat_sys_socketcall+0xdc/0x214
[c0000000421bbe30] c00000000000869c syscall_exit+0x0/0x40
--- Exception: c00 (System Call) at 0000000007f0ca9c
SP (fc0ef8f0) is in userspace

We are using size of security context from xfrm_policy to determine
how much space to alloc skb and then putting security context from
xfrm_state into skb. Should have been using size of security context
from xfrm_state to alloc skb. Following fix does that

Signed-off-by: Joy Latten <latten@austin.ibm.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 1 changed file with 3 additions and 4 deletions Side-by-side Diff

net/xfrm/xfrm_user.c
Diff comments   View file @ 661697f
... ... @@ -272,9 +272,8 @@
272 272 }
273 273  
274 274  
275   -static inline int xfrm_user_sec_ctx_size(struct xfrm_policy *xp)
  275 +static inline int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx)
276 276 {
277   - struct xfrm_sec_ctx *xfrm_ctx = xp->security;
278 277 int len = 0;
279 278  
280 279 if (xfrm_ctx) {
... ... @@ -2170,7 +2169,7 @@
2170 2169  
2171 2170 len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
2172 2171 len += NLMSG_SPACE(sizeof(struct xfrm_user_acquire));
2173   - len += RTA_SPACE(xfrm_user_sec_ctx_size(xp));
  2172 + len += RTA_SPACE(xfrm_user_sec_ctx_size(x->security));
2174 2173 #ifdef CONFIG_XFRM_SUB_POLICY
2175 2174 len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
2176 2175 #endif
... ... @@ -2280,7 +2279,7 @@
2280 2279  
2281 2280 len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
2282 2281 len += NLMSG_SPACE(sizeof(struct xfrm_user_polexpire));
2283   - len += RTA_SPACE(xfrm_user_sec_ctx_size(xp));
  2282 + len += RTA_SPACE(xfrm_user_sec_ctx_size(xp->security));
2284 2283 #ifdef CONFIG_XFRM_SUB_POLICY
2285 2284 len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
2286 2285 #endif