github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

xfrm: state: reject mark with bits outside its mask on add

Browse Source 
A mark/mask like 0x101/0xff is silently truncated to 0x01/0xff on
insert, so the exact-match lookups added later in this series (DELSA,
GETSA, GETAE, NEWAE, EXPIRE, MIGRATE_STATE) could not find the SA.
Reject it instead.

The mark is no longer sanitized on state add.

Also reject an invalid XFRMA_MARK (the new mark) in
XFRM_MSG_MIGRATE_STATE.

Fixes: 0b91fda3a1 ("xfrm: Sanitize marks before insert")
Cc: <stable+noautosel@kernel.org> # needs exact-match SA lookups from this series
Signed-off-by: Antony Antony <antony.antony@secunet.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
This commit is contained in:
Antony Antony 2026-10-07 11:34:28 +02:00 committed by Steffen Klassert
parent f9a11716c8
commit c8c2c8a2bb
2 changed files with 24 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
net/xfrm/xfrm_state.c
View File

@ -1732,9 +1732,6 @@ static void __xfrm_state_insert(struct xfrm_state *x)
list_add(&x->km.all, &net->xfrm.state_all);
/* Sanitize mark before store */
x->mark.v &= x->mark.m;
h = xfrm_dst_hash(net, &x->id.daddr, &x->props.saddr,
x->props.reqid, x->props.family);
XFRM_STATE_INSERT(bydst, &x->bydst,

24
net/xfrm/xfrm_user.c
View File

@ -314,6 +314,22 @@ static int verify_selector_prefixlen(u16 family,
}
}
static int verify_mark(struct nlattr **attrs, struct netlink_ext_ack *extack)
{
const struct xfrm_mark *m;
if (!attrs[XFRMA_MARK])
return 0;
m = nla_data(attrs[XFRMA_MARK]);
if ((m->v & m->m) != m->v) {
NL_SET_ERR_MSG(extack, "Invalid mark value/mask combination");
return -EINVAL;
}
return 0;
}
static int verify_newsa_info(struct xfrm_usersa_info *p,
struct nlattr **attrs,
struct netlink_ext_ack *extack)
@ -333,6 +349,10 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
if (err)
goto out;
err = verify_mark(attrs, extack);
if (err)
goto out;
err = -EINVAL;
switch (p->id.proto) {
case IPPROTO_AH:
@ -3370,6 +3390,10 @@ static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh,
return err;
}
err = verify_mark(attrs, extack);
if (err)
return err;
copy_from_user_migrate_state(&m, um);
x = xfrm_state_lookup(net, m.old_mark.v & m.old_mark.m,