Commit d2ddf628 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec 



Steffen Klassert says:

====================
pull request (net): ipsec 2018-03-13

1) Refuse to insert 32 bit userspace socket policies on 64
   bit systems like we do it for standard policies. We don't
   have a compat layer, so inserting socket policies from
   32 bit userspace will lead to a broken configuration.

2) Make the policy hold queue work without the flowcache.
   Dummy bundles are not chached anymore, so we need to
   generate a new one on each lookup as long as the SAs
   are not yet in place.

3) Fix the validation of the esn replay attribute. The
   The sanity check in verify_replay() is bypassed if
   the XFRM_STATE_ESN flag is not set. Fix this by doing
   the sanity check uncoditionally.
   From Florian Westphal.

4) After most of the dst_entry garbage collection code
   is removed, we may leak xfrm_dst entries as they are
   neither cached nor tracked somewhere. Fix this by
   reusing the 'uncached_list' to track xfrm_dst entries
   too. From Xin Long.

5) Fix a rcu_read_lock/rcu_read_unlock imbalance in
   xfrm_get_tos() From Xin Long.

6) Fix an infinite loop in xfrm_get_dst_nexthop. On
   transport mode we fetch the child dst_entry after
   we continue, so this pointer is never updated.
   Fix this by fetching it before we continue.

7) Fix ESN sequence number gap after IPsec GSO packets.
    We accidentally increment the sequence number counter
    on the xfrm_state by one packet too much in the ESN
    case. Fix this by setting the sequence number to the
    correct value.

8) Reset the ethernet protocol after decapsulation only if a
   mac header was set. Otherwise it breaks configurations
   with TUN devices. From Yossi Kuperman.

9) Fix __this_cpu_read() usage in preemptible code. Use
   this_cpu_read() instead in ipcomp_alloc_tfms().
   From Greg Hackmann.

Please pull or let me know if there are problems.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 5a9f8df6 0dcd7876

include/net/ip6_route.h

+3 −0
Original line number Diff line number Diff line
@@ -179,6 +179,9 @@ void rt6_disable_ip(struct net_device *dev, unsigned long event); 
void rt6_sync_down_dev(struct net_device *dev, unsigned long event);

void rt6_multipath_rebalance(struct rt6_info *rt);



void rt6_uncached_list_add(struct rt6_info *rt);

void rt6_uncached_list_del(struct rt6_info *rt);



static inline const struct rt6_info *skb_rt6_info(const struct sk_buff *skb)

{

	const struct dst_entry *dst = skb_dst(skb);

include/net/route.h

+3 −0
Original line number Diff line number Diff line
@@ -227,6 +227,9 @@ struct in_ifaddr; 
void fib_add_ifaddr(struct in_ifaddr *);

void fib_del_ifaddr(struct in_ifaddr *, struct in_ifaddr *);



void rt_add_uncached_list(struct rtable *rt);

void rt_del_uncached_list(struct rtable *rt);



static inline void ip_rt_put(struct rtable *rt)

{

	/* dst_release() accepts a NULL parameter.

net/ipv4/route.c

+13 −8
Original line number Diff line number Diff line
@@ -1393,7 +1393,7 @@ struct uncached_list { 


static DEFINE_PER_CPU_ALIGNED(struct uncached_list, rt_uncached_list);



static void rt_add_uncached_list(struct rtable *rt)

void rt_add_uncached_list(struct rtable *rt)

{

	struct uncached_list *ul = raw_cpu_ptr(&rt_uncached_list);
@@ -1404,14 +1404,8 @@ static void rt_add_uncached_list(struct rtable *rt) 
	spin_unlock_bh(&ul->lock);

}



static void ipv4_dst_destroy(struct dst_entry *dst)

void rt_del_uncached_list(struct rtable *rt)

{

	struct dst_metrics *p = (struct dst_metrics *)DST_METRICS_PTR(dst);

	struct rtable *rt = (struct rtable *) dst;



	if (p != &dst_default_metrics && refcount_dec_and_test(&p->refcnt))

		kfree(p);



	if (!list_empty(&rt->rt_uncached)) {

		struct uncached_list *ul = rt->rt_uncached_list;
@@ -1421,6 +1415,17 @@ static void ipv4_dst_destroy(struct dst_entry *dst) 
	}

}



static void ipv4_dst_destroy(struct dst_entry *dst)

{

	struct dst_metrics *p = (struct dst_metrics *)DST_METRICS_PTR(dst);

	struct rtable *rt = (struct rtable *)dst;



	if (p != &dst_default_metrics && refcount_dec_and_test(&p->refcnt))

		kfree(p);



	rt_del_uncached_list(rt);

}



void rt_flush_dev(struct net_device *dev)

{

	struct net *net = dev_net(dev);

net/ipv4/xfrm4_mode_tunnel.c

+2 −1
Original line number Diff line number Diff line
@@ -92,6 +92,7 @@ static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb) 


	skb_reset_network_header(skb);

	skb_mac_header_rebuild(skb);

	if (skb->mac_len)

		eth_hdr(skb)->h_proto = skb->protocol;



	err = 0;

net/ipv4/xfrm4_policy.c

+3 −1
Original line number Diff line number Diff line
@@ -102,6 +102,7 @@ static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev, 
	xdst->u.rt.rt_pmtu = rt->rt_pmtu;

	xdst->u.rt.rt_table_id = rt->rt_table_id;

	INIT_LIST_HEAD(&xdst->u.rt.rt_uncached);

	rt_add_uncached_list(&xdst->u.rt);



	return 0;

}
@@ -241,7 +242,8 @@ static void xfrm4_dst_destroy(struct dst_entry *dst) 
	struct xfrm_dst *xdst = (struct xfrm_dst *)dst;



	dst_destroy_metrics_generic(dst);



	if (xdst->u.rt.rt_uncached_list)

		rt_del_uncached_list(&xdst->u.rt);

	xfrm_dst_destroy(xdst);

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE