From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0DAD2C43381 for ; Tue, 19 Mar 2019 05:08:46 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id CF15D20857 for ; Tue, 19 Mar 2019 05:08:45 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="EcFP+y+D" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726053AbfCSFIo (ORCPT ); Tue, 19 Mar 2019 01:08:44 -0400 Received: from mail-pg1-f195.google.com ([209.85.215.195]:33057 "EHLO mail-pg1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725934AbfCSFIo (ORCPT ); Tue, 19 Mar 2019 01:08:44 -0400 Received: by mail-pg1-f195.google.com with SMTP id i7so9809795pgq.0 for ; Mon, 18 Mar 2019 22:08:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=b8AM9HTfpsGqUDMtjM5qxNMlMfbKkNeayMgFaWKbn1Y=; b=EcFP+y+DoKergF6IigOv26Lzp5dxjU5diy/j3MaSMm++07J+WY9g+2Shx05FXKTZkv tkI6WJElexVv989QFyACtL6EWQJZ0eqOLbvWUaCMt5Uk2M3DdCN9kZ1E47nBPtDeOlUa Xe4PFhf7xWQrFL/XvxJSR5fy2oN549oc2dVP3cp8Z1CtyOm7Koc235Zx1q5jTccpPZI8 49sJONJl93V6endWYZ/PDdPUUKWC0xxFoMDsCgxX3vYyeGOTZbtoZmUrCpqLIPSTmxuD 5uPuMFDFSRnakbGvqqc80XNk2rcDqdxL+CfGolCZ1kYg5G+gZpisFJBN5+DRITwxpl0Z c5nw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=b8AM9HTfpsGqUDMtjM5qxNMlMfbKkNeayMgFaWKbn1Y=; b=J8qhY6oqUsO1IjmRzhT80/7jqlMBaSyoMvkqBhISYCEeP4gDrBaXXITP9Pcy5L624y CWAQ2kuiBjLdhkQDzuf9Cr40MIZgaLybBbw/rtRI9630RnGzAnPUPR3VZgY8TdkslYpy CLX3ZwjPsfY1ZpQNv2TJ1VE2a4fLsBpJb4lWi9XxQvJ2j8FeUFAzN6GZrMchdKcMbvFD N6jykhWDguCL+XrI1USicXm6Ri7fDCrpw71Wa3Z3kyakstWDxCpOPMhiSFYll4Tj/pKu 4jZVY7o56MaJPGzD+v3m4NpDtpMf7QDW1w47/Vk50hdAacJxs8p2sZaQt6+rd0l52zbL WRIg== X-Gm-Message-State: APjAAAUNGuE+qqlIsIVY6RGtaoZwhHahxDZxMGjfj2Mxhb3aNtv/rhvj 78NMk/9hHULCULkAKoCMFn6yljUO X-Google-Smtp-Source: APXvYqwUPrCKprfZSF5lpMfK/XK3T6NegFGF51/fQJOnO+YDptOOEC6Uf81t5E4Iiqn3ngGQLdj+lw== X-Received: by 2002:aa7:9313:: with SMTP id 19mr82756pfj.173.1552972123228; Mon, 18 Mar 2019 22:08:43 -0700 (PDT) Received: from tw-172-25-17-123.office.twttr.net ([8.25.197.27]) by smtp.gmail.com with ESMTPSA id r3sm2056941pgb.82.2019.03.18.22.08.40 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Mon, 18 Mar 2019 22:08:40 -0700 (PDT) From: Cong Wang To: netdev@vger.kernel.org Cc: Cong Wang , syzbot+0bf0519d6e0de15914fe@syzkaller.appspotmail.com, Steffen Klassert , Herbert Xu Subject: [Patch net] xfrm: unify xfrm protocol checks Date: Mon, 18 Mar 2019 22:08:24 -0700 Message-Id: <20190319050824.24742-1-xiyou.wangcong@gmail.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org In commit 6a53b7593233 ("xfrm: check id proto in validate_tmpl()") I introduced a check for xfrm protocol, but unfortunately xfrm_id_proto_match() could still miss IPPROTO_ROUTING which causes entries left in net->xfrm.state_all. This patch extracts the check from validate_tmpl() to xfrm_id_proto_valid() and uses it in all other places, including the missing one in parse_ipsecrequest(). Fixes: 6a53b7593233 ("xfrm: check id proto in validate_tmpl()") Reported-by: syzbot+0bf0519d6e0de15914fe@syzkaller.appspotmail.com Cc: Steffen Klassert Cc: Herbert Xu Signed-off-by: Cong Wang --- include/net/xfrm.h | 21 ++++++++++++++++++--- net/key/af_key.c | 4 +++- net/xfrm/xfrm_user.c | 14 +------------- 3 files changed, 22 insertions(+), 17 deletions(-) diff --git a/include/net/xfrm.h b/include/net/xfrm.h index 85386becbaea..22ef7617087d 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -1404,12 +1404,27 @@ static inline int xfrm_state_kern(const struct xfrm_state *x) return atomic_read(&x->tunnel_users); } +static inline bool xfrm_id_proto_valid(u8 proto) +{ + switch (proto) { + case IPPROTO_AH: + case IPPROTO_ESP: + case IPPROTO_COMP: +#if IS_ENABLED(CONFIG_IPV6) + case IPPROTO_ROUTING: + case IPPROTO_DSTOPTS: +#endif + case IPSEC_PROTO_ANY: + return true; + default: + return false; + } +} + static inline int xfrm_id_proto_match(u8 proto, u8 userproto) { return (!userproto || proto == userproto || - (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH || - proto == IPPROTO_ESP || - proto == IPPROTO_COMP))); + (userproto == IPSEC_PROTO_ANY && xfrm_id_proto_valid(proto))); } /* diff --git a/net/key/af_key.c b/net/key/af_key.c index 5651c29cb5bd..4af1e1d60b9f 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -1951,8 +1951,10 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq) if (rq->sadb_x_ipsecrequest_mode == 0) return -EINVAL; + if (!xfrm_id_proto_valid(rq->sadb_x_ipsecrequest_proto)) + return -EINVAL; - t->id.proto = rq->sadb_x_ipsecrequest_proto; /* XXX check proto */ + t->id.proto = rq->sadb_x_ipsecrequest_proto; if ((mode = pfkey_mode_to_xfrm(rq->sadb_x_ipsecrequest_mode)) < 0) return -EINVAL; t->mode = mode; diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index a131f9ff979e..067ac9ed2918 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -1513,20 +1513,8 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family) return -EINVAL; } - switch (ut[i].id.proto) { - case IPPROTO_AH: - case IPPROTO_ESP: - case IPPROTO_COMP: -#if IS_ENABLED(CONFIG_IPV6) - case IPPROTO_ROUTING: - case IPPROTO_DSTOPTS: -#endif - case IPSEC_PROTO_ANY: - break; - default: + if (!xfrm_id_proto_valid(ut[i].id.proto)) return -EINVAL; - } - } return 0; -- 2.20.1