Eric Lee / smarc-fsl-linux-kernel

30 Nov, 2016

1 commit

  • 83e2d0587   xfrm_user: fix return value from xfrm_user_rcv_msg ... Browse Code »

    It doesn't support to run 32bit 'ip' to set xfrm objdect on 64bit host.
    But the return value is unknown for user program:

    ip xfrm policy list
    RTNETLINK answers: Unknown error 524

    Replace ENOTSUPP with EOPNOTSUPP:

    ip xfrm policy list
    RTNETLINK answers: Operation not supported

    Signed-off-by: Yi Zhao
    Signed-off-by: Steffen Klassert

    Yi Zhao
     

18 Nov, 2016

1 commit

  • 330e832ab   xfrm: unbreak xfrm_sk_policy_lookup ... Browse Code »

    if we succeed grabbing the refcount, then
    if (err && !xfrm_pol_hold_rcu)

    will evaluate to false so this hits last else branch which then
    sets policy to ERR_PTR(0).

    Fixes: ae33786f73a7ce ("xfrm: policy: only use rcu in xfrm_sk_policy_lookup")
    Reported-by: Nicolas Dichtel
    Tested-by: Nicolas Dichtel
    Signed-off-by: Florian Westphal
    Signed-off-by: Steffen Klassert

    Florian Westphal
     

30 Sep, 2016

1 commit

24 Sep, 2016

1 commit

23 Sep, 2016

1 commit

21 Sep, 2016

1 commit

  • c2f672fc9   xfrm: state lookup can be lockless ... Browse Code »

    This is called from the packet input path, we get lock contention
    if many cpus handle ipsec in parallel.

    After recent rcu conversion it is safe to call __xfrm_state_lookup
    without the spinlock.

    Signed-off-by: Florian Westphal
    Signed-off-by: Steffen Klassert

    Florian Westphal
     

19 Sep, 2016

1 commit

  • b58847935   xfrm: Fix memory leak of aead algorithm name ... Browse Code »

    commit 1a6509d99122 ("[IPSEC]: Add support for combined mode algorithms")
    introduced aead. The function attach_aead kmemdup()s the algorithm
    name during xfrm_state_construct().
    However this memory is never freed.
    Implementation has since been slightly modified in
    commit ee5c23176fcc ("xfrm: Clone states properly on migration")
    without resolving this leak.
    This patch adds a kfree() call for the aead algorithm name.

    Fixes: 1a6509d99122 ("[IPSEC]: Add support for combined mode algorithms")
    Signed-off-by: Ilan Tayari
    Acked-by: Rami Rosen
    Signed-off-by: Steffen Klassert

    Ilan Tayari
     

13 Sep, 2016

1 commit

11 Sep, 2016

1 commit

09 Sep, 2016

2 commits

  • 2f30ea509   xfrm_user: propagate sec ctx allocation errors ... Browse Code »

    When we fail to attach the security context in xfrm_state_construct()
    we'll return 0 as error value which, in turn, will wrongly claim success
    to userland when, in fact, we won't be adding / updating the XFRM state.

    This is a regression introduced by commit fd21150a0fe1 ("[XFRM] netlink:
    Inline attach_encap_tmpl(), attach_sec_ctx(), and attach_one_addr()").

    Fix it by propagating the error returned by security_xfrm_state_alloc()
    in this case.

    Fixes: fd21150a0fe1 ("[XFRM] netlink: Inline attach_encap_tmpl()...")
    Signed-off-by: Mathias Krause
    Cc: Thomas Graf
    Signed-off-by: Steffen Klassert

    Mathias Krause
     
  • 575f9c43e   Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next ... Browse Code »

    Steffen Klassert says:

    ====================
    ipsec-next 2016-09-08

    1) Constify the xfrm_replay structures. From Julia Lawall

    2) Protect xfrm state hash tables with rcu, lookups
    can be done now without acquiring xfrm_state_lock.
    From Florian Westphal.

    3) Protect xfrm policy hash tables with rcu, lookups
    can be done now without acquiring xfrm_policy_lock.
    From Florian Westphal.

    4) We don't need to have a garbage collector list per
    namespace anymore, so use a global one instead.
    From Florian Westphal.
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     

08 Sep, 2016

1 commit

24 Aug, 2016

2 commits

  • 35db57bbc   xfrm: state: remove per-netns gc task ... Browse Code »

    After commit 5b8ef3415a21f173
    ("xfrm: Remove ancient sleeping when the SA is in acquire state")
    gc does not need any per-netns data anymore.

    As far as gc is concerned all state structs are the same, so we
    can use a global work struct for it.

    Signed-off-by: Florian Westphal
    Signed-off-by: Steffen Klassert

    Florian Westphal
     
  • 4141b36ab   xfrm: Fix xfrm_policy_lock imbalance ... Browse Code »

    An earlier patch accidentally replaced a write_lock_bh
    with a spin_unlock_bh. Fix this by using spin_lock_bh
    instead.

    Fixes: 9d0380df6217 ("xfrm: policy: convert policy_lock to spinlock")
    Signed-off-by: Steffen Klassert

    Steffen Klassert
     

12 Aug, 2016

8 commits

11 Aug, 2016

1 commit

  • 1625f4529   net/xfrm_input: fix possible NULL deref of tunnel.ip6->parms.i_key ... Browse Code »

    Running LTP 'icmp-uni-basic.sh -6 -p ipcomp -m tunnel' test over
    openvswitch + veth can trigger kernel panic:

    BUG: unable to handle kernel NULL pointer dereference
    at 00000000000000e0 IP: [] xfrm_input+0x82/0x750
    ...
    [] xfrm6_rcv_spi+0x1e/0x20
    [] xfrm6_tunnel_rcv+0x42/0x50 [xfrm6_tunnel]
    [] tunnel6_rcv+0x3e/0x8c [tunnel6]
    [] ip6_input_finish+0xd5/0x430
    [] ip6_input+0x33/0x90
    [] ip6_rcv_finish+0xa5/0xb0
    ...

    It seems that tunnel.ip6 can have garbage values and also dereferenced
    without a proper check, only tunnel.ip4 is being verified. Fix it by
    adding one more if block for AF_INET6 and initialize tunnel.ip6 with NULL
    inside xfrm6_rcv_spi() (which is similar to xfrm4_rcv_spi()).

    Fixes: 049f8e2 ("xfrm: Override skb->mark with tunnel->parm.i_key in xfrm_input")

    Signed-off-by: Alexey Kodanev
    Signed-off-by: Steffen Klassert

    Alexey Kodanev
     

10 Aug, 2016

7 commits

29 Jul, 2016

1 commit

  • 6916fb3b1   xfrm: Ignore socket policies when rebuilding hash tables ... Browse Code »

    Whenever thresholds are changed the hash tables are rebuilt. This is
    done by enumerating all policies and hashing and inserting them into
    the right table according to the thresholds and direction.

    Because socket policies are also contained in net->xfrm.policy_all but
    no hash tables are defined for their direction (dir + XFRM_POLICY_MAX)
    this causes a NULL or invalid pointer dereference after returning from
    policy_hash_bysel() if the rebuild is done while any socket policies
    are installed.

    Since the rebuild after changing thresholds is scheduled this crash
    could even occur if the userland sets thresholds seemingly before
    installing any socket policies.

    Fixes: 53c2e285f970 ("xfrm: Do not hash socket policies")
    Signed-off-by: Tobias Brunner
    Acked-by: Herbert Xu
    Signed-off-by: Steffen Klassert

    Tobias Brunner
     

27 Jul, 2016

2 commits

  • 7677c7560   xfrm: get rid of another incorrect WARN ... Browse Code »

    During fuzzing I regularly run into this WARN(). According to Herbert Xu,
    this "certainly shouldn't be a WARN, it probably shouldn't print anything
    either".

    Cc: Stephen Hemminger
    Cc: Steffen Klassert
    Cc: Herbert Xu
    Signed-off-by: Vegard Nossum
    Signed-off-by: Steffen Klassert

    Vegard Nossum
     
  • 73efc3245   xfrm: get rid of incorrect WARN ... Browse Code »

    AFAICT this message is just printed whenever input validation fails.
    This is a normal failure and we shouldn't be dumping the stack over it.

    Looks like it was originally a printk that was maybe incorrectly
    upgraded to a WARN:

    commit 62db5cfd70b1ef53aa21f144a806fe3b78c84fab
    Author: stephen hemminger
    Date: Wed May 12 06:37:06 2010 +0000

    xfrm: add severity to printk

    Cc: Stephen Hemminger
    Cc: Steffen Klassert
    Signed-off-by: Vegard Nossum
    Signed-off-by: Steffen Klassert

    Vegard Nossum
     

18 Jul, 2016

1 commit

  • 1ba5bf993   xfrm: fix crash in XFRM_MSG_GETSA netlink handler ... Browse Code »

    If we hit any of the error conditions inside xfrm_dump_sa(), then
    xfrm_state_walk_init() never gets called. However, we still call
    xfrm_state_walk_done() from xfrm_dump_sa_done(), which will crash
    because the state walk was never initialized properly.

    We can fix this by setting cb->args[0] only after we've processed the
    first element and checking this before calling xfrm_state_walk_done().

    Fixes: d3623099d3 ("ipsec: add support of limited SA dump")
    Cc: Nicolas Dichtel
    Cc: Steffen Klassert
    Signed-off-by: Vegard Nossum
    Acked-by: Nicolas Dichtel
    Signed-off-by: Steffen Klassert

    Vegard Nossum
     

10 May, 2016

1 commit

05 May, 2016

1 commit

  • 32b583a0c   Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec ... Browse Code »

    Steffen Klassert says:

    ====================
    pull request (net): ipsec 2016-05-04

    1) The flowcache can hit an OOM condition if too
    many entries are in the gc_list. Fix this by
    counting the entries in the gc_list and refuse
    new allocations if the value is too high.

    2) The inner headers are invalid after a xfrm transformation,
    so reset the skb encapsulation field to ensure nobody tries
    access the inner headers. Otherwise tunnel devices stacked
    on top of xfrm may build the outer headers based on wrong
    informations.

    3) Add pmtu handling to vti, we need it to report
    pmtu informations for local generated packets.

    Please pull or let me know if there are problems.
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     

24 Apr, 2016

1 commit

25 Mar, 2016

1 commit

  • 071d36bf2   xfrm: Fix crash observed during device unregistration and decryption ... Browse Code »

    A crash is observed when a decrypted packet is processed in receive
    path. get_rps_cpus() tries to dereference the skb->dev fields but it
    appears that the device is freed from the poison pattern.

    [] get_rps_cpu+0x94/0x2f0
    [] netif_rx_internal+0x140/0x1cc
    [] netif_rx+0x74/0x94
    [] xfrm_input+0x754/0x7d0
    [] xfrm_input_resume+0x10/0x1c
    [] esp_input_done+0x20/0x30
    [] process_one_work+0x244/0x3fc
    [] worker_thread+0x2f8/0x418
    [] kthread+0xe0/0xec

    -013|get_rps_cpu(
    | dev = 0xFFFFFFC08B688000,
    | skb = 0xFFFFFFC0C76AAC00 -> (
    | dev = 0xFFFFFFC08B688000 -> (
    | name =
    "......................................................
    | name_hlist = (next = 0xAAAAAAAAAAAAAAAA, pprev =
    0xAAAAAAAAAAA

    Following are the sequence of events observed -

    - Encrypted packet in receive path from netdevice is queued
    - Encrypted packet queued for decryption (asynchronous)
    - Netdevice brought down and freed
    - Packet is decrypted and returned through callback in esp_input_done
    - Packet is queued again for process in network stack using netif_rx

    Since the device appears to have been freed, the dereference of
    skb->dev in get_rps_cpus() leads to an unhandled page fault
    exception.

    Fix this by holding on to device reference when queueing packets
    asynchronously and releasing the reference on call back return.

    v2: Make the change generic to xfrm as mentioned by Steffen and
    update the title to xfrm

    Suggested-by: Herbert Xu
    Signed-off-by: Jerome Stanislaus
    Signed-off-by: Subash Abhinov Kasiviswanathan
    Signed-off-by: David S. Miller

    subashab@codeaurora.org
     

23 Mar, 2016

1 commit

17 Mar, 2016

1 commit