[PATCH ipsec] xfrm: do pskb_pull properly in __xfrm_transport_prep

[PATCH ipsec] xfrm: do pskb_pull properly in __xfrm_transport_prep

[Xin Long]

For transport mode, when ipv6 nexthdr is set, the packet format might
be like:

    ----------------------------------------------------
    |        | dest |     |     |      |  ESP    | ESP |
    | IP6 hdr| opts.| ESP | TCP | Data | Trailer | ICV |
    ----------------------------------------------------

and in __xfrm_transport_prep():

  pskb_pull(skb, skb->mac_len + sizeof(ip6hdr) + x->props.header_len);

it will pull the data pointer to the wrong position, as it missed the
nexthdrs/dest opts.

This patch is to fix it by using:

  pskb_pull(skb, skb_transport_offset(skb) + x->props.header_len);

as we can be sure transport_header points to ESP header at that moment.

It also fixes a panic when packets with ipv6 nexthdr are sent over
esp6 transport mode:

  [  100.473845] kernel BUG at net/core/skbuff.c:4325!
  [  100.478517] RIP: 0010:__skb_to_sgvec+0x252/0x260
  [  100.494355] Call Trace:
  [  100.494829]  skb_to_sgvec+0x11/0x40
  [  100.495492]  esp6_output_tail+0x12e/0x550 [esp6]
  [  100.496358]  esp6_xmit+0x1d5/0x260 [esp6_offload]
  [  100.498029]  validate_xmit_xfrm+0x22f/0x2e0
  [  100.499604]  __dev_queue_xmit+0x589/0x910
  [  100.502928]  ip6_finish_output2+0x2a5/0x5a0
  [  100.503718]  ip6_output+0x6c/0x120
  [  100.505198]  xfrm_output_resume+0x4bf/0x530
  [  100.508683]  xfrm6_output+0x3a/0xc0
  [  100.513446]  inet6_csk_xmit+0xa1/0xf0
  [  100.517335]  tcp_sendmsg+0x27/0x40
  [  100.517977]  sock_sendmsg+0x3e/0x60
  [  100.518648]  __sys_sendto+0xee/0x160

Fixes: c35fe4106b92 ("xfrm: Add mode handlers for IPsec on layer 2")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
---
 net/xfrm/xfrm_device.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
index 6cc7f7f..f50d1f9 100644
--- a/net/xfrm/xfrm_device.c
+++ b/net/xfrm/xfrm_device.c
@@ -25,12 +25,10 @@ static void __xfrm_transport_prep(struct xfrm_state *x, struct sk_buff *skb,
 	struct xfrm_offload *xo = xfrm_offload(skb);
 
 	skb_reset_mac_len(skb);
-	pskb_pull(skb, skb->mac_len + hsize + x->props.header_len);
-
-	if (xo->flags & XFRM_GSO_SEGMENT) {
-		skb_reset_transport_header(skb);
+	if (xo->flags & XFRM_GSO_SEGMENT)
 		skb->transport_header -= x->props.header_len;
-	}
+
+	pskb_pull(skb, skb_transport_offset(skb) + x->props.header_len);
 }
 
 static void __xfrm_mode_tunnel_prep(struct xfrm_state *x, struct sk_buff *skb,
-- 
2.1.0

Re: [PATCH ipsec] xfrm: do pskb_pull properly in __xfrm_transport_prep

[Steffen Klassert]

On Fri, Apr 10, 2020 at 05:06:31PM +0800, Xin Long wrote:
> For transport mode, when ipv6 nexthdr is set, the packet format might
> be like:
> 
>     ----------------------------------------------------
>     |        | dest |     |     |      |  ESP    | ESP |
>     | IP6 hdr| opts.| ESP | TCP | Data | Trailer | ICV |
>     ----------------------------------------------------
> 
> and in __xfrm_transport_prep():
> 
>   pskb_pull(skb, skb->mac_len + sizeof(ip6hdr) + x->props.header_len);
> 
> it will pull the data pointer to the wrong position, as it missed the
> nexthdrs/dest opts.
> 
> This patch is to fix it by using:
> 
>   pskb_pull(skb, skb_transport_offset(skb) + x->props.header_len);
> 
> as we can be sure transport_header points to ESP header at that moment.
> 
> It also fixes a panic when packets with ipv6 nexthdr are sent over
> esp6 transport mode:
> 
>   [  100.473845] kernel BUG at net/core/skbuff.c:4325!
>   [  100.478517] RIP: 0010:__skb_to_sgvec+0x252/0x260
>   [  100.494355] Call Trace:
>   [  100.494829]  skb_to_sgvec+0x11/0x40
>   [  100.495492]  esp6_output_tail+0x12e/0x550 [esp6]
>   [  100.496358]  esp6_xmit+0x1d5/0x260 [esp6_offload]
>   [  100.498029]  validate_xmit_xfrm+0x22f/0x2e0
>   [  100.499604]  __dev_queue_xmit+0x589/0x910
>   [  100.502928]  ip6_finish_output2+0x2a5/0x5a0
>   [  100.503718]  ip6_output+0x6c/0x120
>   [  100.505198]  xfrm_output_resume+0x4bf/0x530
>   [  100.508683]  xfrm6_output+0x3a/0xc0
>   [  100.513446]  inet6_csk_xmit+0xa1/0xf0
>   [  100.517335]  tcp_sendmsg+0x27/0x40
>   [  100.517977]  sock_sendmsg+0x3e/0x60
>   [  100.518648]  __sys_sendto+0xee/0x160
> 
> Fixes: c35fe4106b92 ("xfrm: Add mode handlers for IPsec on layer 2")
> Signed-off-by: Xin Long <lucien.xin@gmail.com>

Applied, thanks!