forked from ~ljy/RK356X_SDK_RELEASE
blame | history | patch | commit | commitdiff
hc
2024-10-09 244b2c5ca8b14627e4a17755e5922221e121c771 
 kernel/net/ipv4/cipso_ipv4.c
....@@ -1,3 +1,4 @@
1
+// SPDX-License-Identifier: GPL-2.0-or-later
12 /*
23  * CIPSO - Commercial IP Security Option
34  *
....@@ -9,30 +10,15 @@
910  *
1011  * The CIPSO draft specification can be found in the kernel's Documentation
1112  * directory as well as the following URL:
12
- *   http://tools.ietf.org/id/draft-ietf-cipso-ipsecurity-01.txt
13
+ *   https://tools.ietf.org/id/draft-ietf-cipso-ipsecurity-01.txt
1314  * The FIPS-188 specification can be found at the following URL:
14
- *   http://www.itl.nist.gov/fipspubs/fip188.htm
15
+ *   https://www.itl.nist.gov/fipspubs/fip188.htm
1516  *
1617  * Author: Paul Moore <paul.moore@hp.com>
17
- *
1818  */
1919 
2020 /*
2121  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
22
- *
23
- * This program is free software;  you can redistribute it and/or modify
24
- * it under the terms of the GNU General Public License as published by
25
- * the Free Software Foundation; either version 2 of the License, or
26
- * (at your option) any later version.
27
- *
28
- * This program is distributed in the hope that it will be useful,
29
- * but WITHOUT ANY WARRANTY;  without even the implied warranty of
30
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
31
- * the GNU General Public License for more details.
32
- *
33
- * You should have received a copy of the GNU General Public License
34
- * along with this program;  if not, see <http://www.gnu.org/licenses/>.
35
- *
3622  */
3723 
3824 #include <linux/init.h>
....@@ -254,7 +240,7 @@
254240 	struct cipso_v4_map_cache_entry *prev_entry = NULL;
255241 	u32 hash;
256242 
257
-	if (!cipso_v4_cache_enabled)
243
+	if (!READ_ONCE(cipso_v4_cache_enabled))
258244 		return -ENOENT;
259245 
260246 	hash = cipso_v4_map_cache_hash(key, key_len);
....@@ -297,7 +283,7 @@
297283 
298284 /**
299285  * cipso_v4_cache_add - Add an entry to the CIPSO cache
300
- * @skb: the packet
286
+ * @cipso_ptr: pointer to CIPSO IP option
301287  * @secattr: the packet's security attributes
302288  *
303289  * Description:
....@@ -311,13 +297,14 @@
311297 int cipso_v4_cache_add(const unsigned char *cipso_ptr,
312298 		       const struct netlbl_lsm_secattr *secattr)
313299 {
300
+	int bkt_size = READ_ONCE(cipso_v4_cache_bucketsize);
314301 	int ret_val = -EPERM;
315302 	u32 bkt;
316303 	struct cipso_v4_map_cache_entry *entry = NULL;
317304 	struct cipso_v4_map_cache_entry *old_entry = NULL;
318305 	u32 cipso_ptr_len;
319306 
320
-	if (!cipso_v4_cache_enabled || cipso_v4_cache_bucketsize <= 0)
307
+	if (!READ_ONCE(cipso_v4_cache_enabled) || bkt_size <= 0)
321308 		return 0;
322309 
323310 	cipso_ptr_len = cipso_ptr[1];
....@@ -337,7 +324,7 @@
337324 
338325 	bkt = entry->hash & (CIPSO_V4_CACHE_BUCKETS - 1);
339326 	spin_lock_bh(&cipso_v4_cache[bkt].lock);
340
-	if (cipso_v4_cache[bkt].size < cipso_v4_cache_bucketsize) {
327
+	if (cipso_v4_cache[bkt].size < bkt_size) {
341328 		list_add(&entry->list, &cipso_v4_cache[bkt].list);
342329 		cipso_v4_cache[bkt].size += 1;
343330 	} else {
....@@ -513,7 +500,7 @@
513500 /**
514501  * cipso_v4_doi_remove - Remove an existing DOI from the CIPSO protocol engine
515502  * @doi: the DOI value
516
- * @audit_secid: the LSM secid to use in the audit message
503
+ * @audit_info: NetLabel audit information
517504  *
518505  * Description:
519506  * Removes a DOI definition from the CIPSO engine.  The NetLabel routines will
....@@ -1214,7 +1201,8 @@
12141201 		/* This will send packets using the "optimized" format when
12151202 		 * possible as specified in  section 3.4.2.6 of the
12161203 		 * CIPSO draft. */
1217
-		if (cipso_v4_rbm_optfmt && ret_val > 0 && ret_val <= 10)
1204
+		if (READ_ONCE(cipso_v4_rbm_optfmt) && ret_val > 0 &&
1205
+		    ret_val <= 10)
12181206 			tag_len = 14;
12191207 		else
12201208 			tag_len = 4 + ret_val;
....@@ -1541,6 +1529,7 @@
15411529 
15421530 /**
15431531  * cipso_v4_validate - Validate a CIPSO option
1532
+ * @skb: the packet
15441533  * @option: the start of the option, on error it is set to point to the error
15451534  *
15461535  * Description:
....@@ -1617,7 +1606,7 @@
16171606 			 * all the CIPSO validations here but it doesn't
16181607 			 * really specify _exactly_ what we need to validate
16191608 			 * ... so, just make it a sysctl tunable. */
1620
-			if (cipso_v4_rbm_strictvalid) {
1609
+			if (READ_ONCE(cipso_v4_rbm_strictvalid)) {
16211610 				if (cipso_v4_map_lvl_valid(doi_def,
16221611 							   tag[3]) < 0) {
16231612 					err_offset = opt_iter + 3;
....@@ -2072,7 +2061,7 @@
20722061 
20732062 /**
20742063  * cipso_v4_req_delattr - Delete the CIPSO option from a request socket
2075
- * @reg: the request socket
2064
+ * @req: the request socket
20762065  *
20772066  * Description:
20782067  * Removes the CIPSO option from a request socket, if present.
....@@ -2164,6 +2153,7 @@
21642153 /**
21652154  * cipso_v4_skbuff_setattr - Set the CIPSO option on a packet
21662155  * @skb: the packet
2156
+ * @doi_def: the DOI structure
21672157  * @secattr: the security attributes
21682158  *
21692159  * Description: