Commit f10e0010 authored by Su Yanjun's avatar Su Yanjun Committed by Steffen Klassert
Browse files

net: xfrm: Add '_rcu' tag for rcu protected pointer in netns_xfrm 



For rcu protected pointers, we'd better add '__rcu' for them.

Once added '__rcu' tag for rcu protected pointer, the sparse tool reports
warnings.

net/xfrm/xfrm_user.c:1198:39: sparse:    expected struct sock *sk
net/xfrm/xfrm_user.c:1198:39: sparse:    got struct sock [noderef] <asn:4> *nlsk
[...]

So introduce a new wrapper function of nlmsg_unicast  to handle type
conversions.

This patch also fixes a direct access of a rcu protected socket.

Fixes: be33690d("[XFRM]: Fix aevent related crash")
Signed-off-by: default avatarSu Yanjun <suyj.fnst@cn.fujitsu.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent 6ed69184

include/net/netns/xfrm.h

+1 −1
Original line number Diff line number Diff line
@@ -57,7 +57,7 @@ struct netns_xfrm { 
	struct list_head	inexact_bins;





	struct sock		*nlsk;

	struct sock		__rcu *nlsk;

	struct sock		*nlsk_stash;



	u32			sysctl_aevent_etime;

net/xfrm/xfrm_user.c

+23 −7
Original line number Diff line number Diff line
@@ -1071,6 +1071,22 @@ static inline int xfrm_nlmsg_multicast(struct net *net, struct sk_buff *skb, 
	return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC);

}



/* A similar wrapper like xfrm_nlmsg_multicast checking that nlsk is still

 * available.

 */

static inline int xfrm_nlmsg_unicast(struct net *net, struct sk_buff *skb,

				     u32 pid)

{

	struct sock *nlsk = rcu_dereference(net->xfrm.nlsk);



	if (!nlsk) {

		kfree_skb(skb);

		return -EPIPE;

	}



	return nlmsg_unicast(nlsk, skb, pid);

}



static inline unsigned int xfrm_spdinfo_msgsize(void)

{

	return NLMSG_ALIGN(4)
@@ -1195,7 +1211,7 @@ static int xfrm_get_spdinfo(struct sk_buff *skb, struct nlmsghdr *nlh, 
	err = build_spdinfo(r_skb, net, sportid, seq, *flags);

	BUG_ON(err < 0);



	return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid);

	return xfrm_nlmsg_unicast(net, r_skb, sportid);

}



static inline unsigned int xfrm_sadinfo_msgsize(void)
@@ -1254,7 +1270,7 @@ static int xfrm_get_sadinfo(struct sk_buff *skb, struct nlmsghdr *nlh, 
	err = build_sadinfo(r_skb, net, sportid, seq, *flags);

	BUG_ON(err < 0);



	return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid);

	return xfrm_nlmsg_unicast(net, r_skb, sportid);

}



static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
@@ -1274,7 +1290,7 @@ static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh, 
	if (IS_ERR(resp_skb)) {

		err = PTR_ERR(resp_skb);

	} else {

		err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid);

		err = xfrm_nlmsg_unicast(net, resp_skb, NETLINK_CB(skb).portid);

	}

	xfrm_state_put(x);

out_noput:
@@ -1337,7 +1353,7 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh, 
		goto out;

	}



	err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid);

	err = xfrm_nlmsg_unicast(net, resp_skb, NETLINK_CB(skb).portid);



out:

	xfrm_state_put(x);
@@ -1903,7 +1919,7 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, 
		if (IS_ERR(resp_skb)) {

			err = PTR_ERR(resp_skb);

		} else {

			err = nlmsg_unicast(net->xfrm.nlsk, resp_skb,

			err = xfrm_nlmsg_unicast(net, resp_skb,

						 NETLINK_CB(skb).portid);

		}

	} else {
@@ -2062,7 +2078,7 @@ static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh, 
	err = build_aevent(r_skb, x, &c);

	BUG_ON(err < 0);



	err = nlmsg_unicast(net->xfrm.nlsk, r_skb, NETLINK_CB(skb).portid);

	err = xfrm_nlmsg_unicast(net, r_skb, NETLINK_CB(skb).portid);

	spin_unlock_bh(&x->lock);

	xfrm_state_put(x);

	return err;

CRA Git | Maintained and supported by SUSTech CRA and CCSE