mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 01:10:04 +00:00
xfrm: enforce validity of offload input flags
commit7c76ecd9c9
upstream. struct xfrm_user_offload has flags variable that received user input, but kernel didn't check if valid bits were provided. It caused a situation where not sanitized input was forwarded directly to the drivers. For example, XFRM_OFFLOAD_IPV6 define that was exposed, was used by strongswan, but not implemented in the kernel at all. As a solution, check and sanitize input flags to forward XFRM_OFFLOAD_INBOUND to the drivers. Fixes:d77e38e612
("xfrm: Add an IPsec hardware offloading API") Signed-off-by: Leon Romanovsky <leonro@nvidia.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
05f7927b25
commit
ab4fa0d4f8
2 changed files with 11 additions and 1 deletions
|
@ -501,6 +501,12 @@ struct xfrm_user_offload {
|
|||
int ifindex;
|
||||
__u8 flags;
|
||||
};
|
||||
/* This flag was exposed without any kernel code that supporting it.
|
||||
* Unfortunately, strongswan has the code that uses sets this flag,
|
||||
* which makes impossible to reuse this bit.
|
||||
*
|
||||
* So leave it here to make sure that it won't be reused by mistake.
|
||||
*/
|
||||
#define XFRM_OFFLOAD_IPV6 1
|
||||
#define XFRM_OFFLOAD_INBOUND 2
|
||||
|
||||
|
|
|
@ -69,6 +69,9 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
|
|||
if (x->encap || x->tfcpad || (x->props.flags & XFRM_STATE_ESN))
|
||||
return 0;
|
||||
|
||||
if (xuo->flags & ~(XFRM_OFFLOAD_IPV6 | XFRM_OFFLOAD_INBOUND))
|
||||
return -EINVAL;
|
||||
|
||||
dev = dev_get_by_index(net, xuo->ifindex);
|
||||
if (!dev) {
|
||||
if (!(xuo->flags & XFRM_OFFLOAD_INBOUND)) {
|
||||
|
@ -98,7 +101,8 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
|
|||
|
||||
xso->dev = dev;
|
||||
xso->num_exthdrs = 1;
|
||||
xso->flags = xuo->flags;
|
||||
/* Don't forward bit that is not implemented */
|
||||
xso->flags = xuo->flags & ~XFRM_OFFLOAD_IPV6;
|
||||
|
||||
err = dev->xfrmdev_ops->xdo_dev_state_add(x);
|
||||
if (err) {
|
||||
|
|
Loading…
Reference in a new issue