forked from ~ljy/RK356X_SDK_RELEASE

hc
2023-12-09 b22da3d8526a935aa31e086e63f60ff3246cb61c
kernel/net/xfrm/xfrm_compat.c
....@@ -216,7 +216,7 @@
216216 case XFRM_MSG_GETSADINFO:
217217 case XFRM_MSG_GETSPDINFO:
218218 default:
219
- WARN_ONCE(1, "unsupported nlmsg_type %d", nlh_src->nlmsg_type);
219
+ pr_warn_once("unsupported nlmsg_type %d\n", nlh_src->nlmsg_type);
220220 return ERR_PTR(-EOPNOTSUPP);
221221 }
222222
....@@ -234,6 +234,7 @@
234234 case XFRMA_PAD:
235235 /* Ignore */
236236 return 0;
237
+ case XFRMA_UNSPEC:
237238 case XFRMA_ALG_AUTH:
238239 case XFRMA_ALG_CRYPT:
239240 case XFRMA_ALG_COMP:
....@@ -276,7 +277,7 @@
276277 return xfrm_nla_cpy(dst, src, nla_len(src));
277278 default:
278279 BUILD_BUG_ON(XFRMA_MAX != XFRMA_IF_ID);
279
- WARN_ONCE(1, "unsupported nla_type %d", src->nla_type);
280
+ pr_warn_once("unsupported nla_type %d\n", src->nla_type);
280281 return -EOPNOTSUPP;
281282 }
282283 }
....@@ -297,8 +298,16 @@
297298 len = nlmsg_attrlen(nlh_src, xfrm_msg_min[type]);
298299
299300 nla_for_each_attr(nla, attrs, len, remaining) {
300
- int err = xfrm_xlate64_attr(dst, nla);
301
+ int err;
301302
303
+ switch (type) {
304
+ case XFRM_MSG_NEWSPDINFO:
305
+ err = xfrm_nla_cpy(dst, nla, nla_len(nla));
306
+ break;
307
+ default:
308
+ err = xfrm_xlate64_attr(dst, nla);
309
+ break;
310
+ }
302311 if (err)
303312 return err;
304313 }
....@@ -314,8 +323,10 @@
314323 struct sk_buff *new = NULL;
315324 int err;
316325
317
- if (WARN_ON_ONCE(type >= ARRAY_SIZE(xfrm_msg_min)))
326
+ if (type >= ARRAY_SIZE(xfrm_msg_min)) {
327
+ pr_warn_once("unsupported nlmsg_type %d\n", nlh_src->nlmsg_type);
318328 return -EOPNOTSUPP;
329
+ }
319330
320331 if (skb_shinfo(skb)->frag_list == NULL) {
321332 new = alloc_skb(skb->len + skb_tailroom(skb), GFP_ATOMIC);
....@@ -338,7 +349,8 @@
338349
339350 /* Calculates len of translated 64-bit message. */
340351 static size_t xfrm_user_rcv_calculate_len64(const struct nlmsghdr *src,
341
- struct nlattr *attrs[XFRMA_MAX+1])
352
+ struct nlattr *attrs[XFRMA_MAX + 1],
353
+ int maxtype)
342354 {
343355 size_t len = nlmsg_len(src);
344356
....@@ -355,9 +367,19 @@
355367 case XFRM_MSG_POLEXPIRE:
356368 len += 8;
357369 break;
370
+ case XFRM_MSG_NEWSPDINFO:
371
+ /* attirbutes are xfrm_spdattr_type_t, not xfrm_attr_type_t */
372
+ return len;
358373 default:
359374 break;
360375 }
376
+
377
+ /* Unexpected for anything, but XFRM_MSG_NEWSPDINFO, please
378
+ * correct both 64=>32-bit and 32=>64-bit translators to copy
379
+ * new attributes.
380
+ */
381
+ if (WARN_ON_ONCE(maxtype))
382
+ return len;
361383
362384 if (attrs[XFRMA_SA])
363385 len += 4;
....@@ -377,6 +399,10 @@
377399 struct nlmsghdr *nlmsg = dst;
378400 struct nlattr *nla;
379401
402
+ /* xfrm_user_rcv_msg_compat() relies on fact that 32-bit messages
403
+ * have the same len or shorted than 64-bit ones.
404
+ * 32-bit translation that is bigger than 64-bit original is unexpected.
405
+ */
380406 if (WARN_ON_ONCE(copy_len > payload))
381407 copy_len = payload;
382408
....@@ -387,7 +413,7 @@
387413
388414 memcpy(nla, src, nla_attr_size(copy_len));
389415 nla->nla_len = nla_attr_size(payload);
390
- *pos += nla_attr_size(payload);
416
+ *pos += nla_attr_size(copy_len);
391417 nlmsg->nlmsg_len += nla->nla_len;
392418
393419 memset(dst + *pos, 0, payload - copy_len);
....@@ -433,7 +459,8 @@
433459
434460 static int xfrm_xlate32(struct nlmsghdr *dst, const struct nlmsghdr *src,
435461 struct nlattr *attrs[XFRMA_MAX+1],
436
- size_t size, u8 type, struct netlink_ext_ack *extack)
462
+ size_t size, u8 type, int maxtype,
463
+ struct netlink_ext_ack *extack)
437464 {
438465 size_t pos;
439466 int i;
....@@ -513,6 +540,25 @@
513540 }
514541 pos = dst->nlmsg_len;
515542
543
+ if (maxtype) {
544
+ /* attirbutes are xfrm_spdattr_type_t, not xfrm_attr_type_t */
545
+ WARN_ON_ONCE(src->nlmsg_type != XFRM_MSG_NEWSPDINFO);
546
+
547
+ for (i = 1; i <= maxtype; i++) {
548
+ int err;
549
+
550
+ if (!attrs[i])
551
+ continue;
552
+
553
+ /* just copy - no need for translation */
554
+ err = xfrm_attr_cpy32(dst, &pos, attrs[i], size,
555
+ nla_len(attrs[i]), nla_len(attrs[i]));
556
+ if (err)
557
+ return err;
558
+ }
559
+ return 0;
560
+ }
561
+
516562 for (i = 1; i < XFRMA_MAX + 1; i++) {
517563 int err;
518564
....@@ -552,22 +598,22 @@
552598 (h32->nlmsg_flags & NLM_F_DUMP))
553599 return NULL;
554600
555
- err = nlmsg_parse(h32, compat_msg_min[type], attrs,
601
+ err = nlmsg_parse_deprecated(h32, compat_msg_min[type], attrs,
556602 maxtype ? : XFRMA_MAX, policy ? : compat_policy, extack);
557603 if (err < 0)
558604 return ERR_PTR(err);
559605
560
- len = xfrm_user_rcv_calculate_len64(h32, attrs);
606
+ len = xfrm_user_rcv_calculate_len64(h32, attrs, maxtype);
561607 /* The message doesn't need translation */
562608 if (len == nlmsg_len(h32))
563609 return NULL;
564610
565611 len += NLMSG_HDRLEN;
566
- h64 = kvmalloc(len, GFP_KERNEL | __GFP_ZERO);
612
+ h64 = kvmalloc(len, GFP_KERNEL);
567613 if (!h64)
568614 return ERR_PTR(-ENOMEM);
569615
570
- err = xfrm_xlate32(h64, h32, attrs, len, type, extack);
616
+ err = xfrm_xlate32(h64, h32, attrs, len, type, maxtype, extack);
571617 if (err < 0) {
572618 kvfree(h64);
573619 return ERR_PTR(err);
....@@ -585,7 +631,7 @@
585631 if (optlen < sizeof(*p))
586632 return -EINVAL;
587633
588
- data64 = kmalloc(optlen + 4, GFP_USER | __GFP_NOWARN);
634
+ data64 = kmalloc_track_caller(optlen + 4, GFP_USER | __GFP_NOWARN);
589635 if (!data64)
590636 return -ENOMEM;
591637