mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-29 22:02:02 +00:00
Code Issues Releases Wiki Activity

net: xfrm: Add '_rcu' tag for rcu protected pointer in netns_xfrm

Browse source 
For rcu protected pointers, we'd better add '__rcu' for them.

Once added '__rcu' tag for rcu protected pointer, the sparse tool reports
warnings.

net/xfrm/xfrm_user.c:1198:39: sparse:    expected struct sock *sk
net/xfrm/xfrm_user.c:1198:39: sparse:    got struct sock [noderef] <asn:4> *nlsk
[...]

So introduce a new wrapper function of nlmsg_unicast  to handle type
conversions.

This patch also fixes a direct access of a rcu protected socket.

Fixes: be33690d8fcf("[XFRM]: Fix aevent related crash")
Signed-off-by: Su Yanjun <suyj.fnst@cn.fujitsu.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
This commit is contained in:
Su Yanjun 2019-03-06 20:54:08 -05:00 committed by Steffen Klassert
parent 6ed69184ed
commit f10e0010fa
2 changed files with 24 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
include/net/netns/xfrm.h
View file

@ -57,7 +57,7 @@ struct netns_xfrm {
struct list_head inexact_bins;
struct sock *nlsk;
struct sock __rcu *nlsk;
struct sock *nlsk_stash;
u32 sysctl_aevent_etime;

30
net/xfrm/xfrm_user.c
View file

@ -1071,6 +1071,22 @@ static inline int xfrm_nlmsg_multicast(struct net *net, struct sk_buff *skb,
return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC);
}
/* A similar wrapper like xfrm_nlmsg_multicast checking that nlsk is still
* available.
*/
static inline int xfrm_nlmsg_unicast(struct net *net, struct sk_buff *skb,
u32 pid)
{
struct sock *nlsk = rcu_dereference(net->xfrm.nlsk);
if (!nlsk) {
kfree_skb(skb);
return -EPIPE;
}
return nlmsg_unicast(nlsk, skb, pid);
}
static inline unsigned int xfrm_spdinfo_msgsize(void)
{
return NLMSG_ALIGN(4)
@ -1195,7 +1211,7 @@ static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
err = build_spdinfo(r_skb, net, sportid, seq, *flags);
BUG_ON(err < 0);
return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid);
return xfrm_nlmsg_unicast(net, r_skb, sportid);
}
static inline unsigned int xfrm_sadinfo_msgsize(void)
@ -1254,7 +1270,7 @@ static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh,
err = build_sadinfo(r_skb, net, sportid, seq, *flags);
BUG_ON(err < 0);
return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid);
return xfrm_nlmsg_unicast(net, r_skb, sportid);
}
static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
@ -1274,7 +1290,7 @@ static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
if (IS_ERR(resp_skb)) {
err = PTR_ERR(resp_skb);
} else {
err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid);
err = xfrm_nlmsg_unicast(net, resp_skb, NETLINK_CB(skb).portid);
}
xfrm_state_put(x);
out_noput:
@ -1337,7 +1353,7 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
goto out;
}
err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid);
err = xfrm_nlmsg_unicast(net, resp_skb, NETLINK_CB(skb).portid);
out:
xfrm_state_put(x);
@ -1903,8 +1919,8 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
if (IS_ERR(resp_skb)) {
err = PTR_ERR(resp_skb);
} else {
err = nlmsg_unicast(net->xfrm.nlsk, resp_skb,
NETLINK_CB(skb).portid);
err = xfrm_nlmsg_unicast(net, resp_skb,
NETLINK_CB(skb).portid);
}
} else {
xfrm_audit_policy_delete(xp, err ? 0 : 1, true);
@ -2062,7 +2078,7 @@ static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
err = build_aevent(r_skb, x, &c);
BUG_ON(err < 0);
err = nlmsg_unicast(net->xfrm.nlsk, r_skb, NETLINK_CB(skb).portid);
err = xfrm_nlmsg_unicast(net, r_skb, NETLINK_CB(skb).portid);
spin_unlock_bh(&x->lock);
xfrm_state_put(x);
return err;