github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-03 12:03:54 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

xfrm: Fix the usage of skb->sk

Browse Source 
xfrm assumed to always have a full socket at skb->sk.
This is not always true, so fix it by converting to a
full socket before it is used.

Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
This commit is contained in:
Steffen Klassert 2025-01-16 11:46:03 +01:00
parent 600258d555
commit 1620c88887
6 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
net/ipv4/esp4.c
View File

@ -279,7 +279,7 @@ static void esp_output_done(void *data, int err)
x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP) x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)
esp_output_tail_tcp(x, skb); esp_output_tail_tcp(x, skb);
else else
xfrm_output_resume(skb->sk, skb, err); xfrm_output_resume(skb_to_full_sk(skb), skb, err);
} }
} }

2
net/ipv6/esp6.c
View File

@ -315,7 +315,7 @@ static void esp_output_done(void *data, int err)
x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP) x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)
esp_output_tail_tcp(x, skb); esp_output_tail_tcp(x, skb);
else else
xfrm_output_resume(skb->sk, skb, err); xfrm_output_resume(skb_to_full_sk(skb), skb, err);
} }
} }

4
net/ipv6/xfrm6_output.c
View File

@ -82,14 +82,14 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
toobig = skb->len > mtu && !skb_is_gso(skb); toobig = skb->len > mtu && !skb_is_gso(skb);
if (toobig && xfrm6_local_dontfrag(skb->sk)) { if (toobig && xfrm6_local_dontfrag(sk)) {
xfrm6_local_rxpmtu(skb, mtu); xfrm6_local_rxpmtu(skb, mtu);
kfree_skb(skb); kfree_skb(skb);
return -EMSGSIZE; return -EMSGSIZE;
} else if (toobig && xfrm6_noneed_fragment(skb)) { } else if (toobig && xfrm6_noneed_fragment(skb)) {
skb->ignore_df = 1; skb->ignore_df = 1;
goto skip_frag; goto skip_frag;
} else if (!skb->ignore_df && toobig && skb->sk) { } else if (!skb->ignore_df && toobig && sk) {
xfrm_local_error(skb, mtu); xfrm_local_error(skb, mtu);
kfree_skb(skb); kfree_skb(skb);
return -EMSGSIZE; return -EMSGSIZE;

2
net/xfrm/xfrm_interface_core.c
View File

@ -506,7 +506,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
skb_dst_set(skb, dst); skb_dst_set(skb, dst);
skb->dev = tdev; skb->dev = tdev;
err = dst_output(xi->net, skb->sk, skb); err = dst_output(xi->net, skb_to_full_sk(skb), skb);
if (net_xmit_eval(err) == 0) { if (net_xmit_eval(err) == 0) {
dev_sw_netstats_tx_add(dev, 1, length); dev_sw_netstats_tx_add(dev, 1, length);
} else { } else {

7
net/xfrm/xfrm_output.c
View File

@ -796,7 +796,7 @@ static int xfrm4_tunnel_check_size(struct sk_buff *skb)
!skb_gso_validate_network_len(skb, ip_skb_dst_mtu(skb->sk, skb)))) { !skb_gso_validate_network_len(skb, ip_skb_dst_mtu(skb->sk, skb)))) {
skb->protocol = htons(ETH_P_IP); skb->protocol = htons(ETH_P_IP);
if (skb->sk) if (skb->sk && sk_fullsock(skb->sk))
xfrm_local_error(skb, mtu); xfrm_local_error(skb, mtu);
else else
icmp_send(skb, ICMP_DEST_UNREACH, icmp_send(skb, ICMP_DEST_UNREACH,
@ -832,6 +832,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
{ {
int mtu, ret = 0; int mtu, ret = 0;
struct dst_entry *dst = skb_dst(skb); struct dst_entry *dst = skb_dst(skb);
struct sock *sk = skb_to_full_sk(skb);
if (skb->ignore_df) if (skb->ignore_df)
goto out; goto out;
@ -846,9 +847,9 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
skb->dev = dst->dev; skb->dev = dst->dev;
skb->protocol = htons(ETH_P_IPV6); skb->protocol = htons(ETH_P_IPV6);
if (xfrm6_local_dontfrag(skb->sk)) if (xfrm6_local_dontfrag(sk))
ipv6_stub->xfrm6_local_rxpmtu(skb, mtu); ipv6_stub->xfrm6_local_rxpmtu(skb, mtu);
else if (skb->sk) else if (sk)
xfrm_local_error(skb, mtu); xfrm_local_error(skb, mtu);
else else
icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);

2
net/xfrm/xfrm_policy.c
View File

@ -2959,7 +2959,7 @@ static void xfrm_policy_queue_process(struct timer_list *t)
skb_dst_drop(skb); skb_dst_drop(skb);
skb_dst_set(skb, dst); skb_dst_set(skb, dst);
dst_output(net, skb->sk, skb); dst_output(net, skb_to_full_sk(skb), skb);
} }
out: out: