1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * XFRM compat layer
4 * Author: Dmitry Safonov <dima@arista.com>
5 * Based on code and translator idea by: Florian Westphal <fw@strlen.de>
6 */
7 #include <linux/compat.h>
8 #include <linux/xfrm.h>
9 #include <net/xfrm.h>
10
11 struct compat_xfrm_lifetime_cfg {
12 compat_u64 soft_byte_limit, hard_byte_limit;
13 compat_u64 soft_packet_limit, hard_packet_limit;
14 compat_u64 soft_add_expires_seconds, hard_add_expires_seconds;
15 compat_u64 soft_use_expires_seconds, hard_use_expires_seconds;
16 }; /* same size on 32bit, but only 4 byte alignment required */
17
18 struct compat_xfrm_lifetime_cur {
19 compat_u64 bytes, packets, add_time, use_time;
20 }; /* same size on 32bit, but only 4 byte alignment required */
21
22 struct compat_xfrm_userpolicy_info {
23 struct xfrm_selector sel;
24 struct compat_xfrm_lifetime_cfg lft;
25 struct compat_xfrm_lifetime_cur curlft;
26 __u32 priority, index;
27 u8 dir, action, flags, share;
28 /* 4 bytes additional padding on 64bit */
29 };
30
31 struct compat_xfrm_usersa_info {
32 struct xfrm_selector sel;
33 struct xfrm_id id;
34 xfrm_address_t saddr;
35 struct compat_xfrm_lifetime_cfg lft;
36 struct compat_xfrm_lifetime_cur curlft;
37 struct xfrm_stats stats;
38 __u32 seq, reqid;
39 u16 family;
40 u8 mode, replay_window, flags;
41 /* 4 bytes additional padding on 64bit */
42 };
43
44 struct compat_xfrm_user_acquire {
45 struct xfrm_id id;
46 xfrm_address_t saddr;
47 struct xfrm_selector sel;
48 struct compat_xfrm_userpolicy_info policy;
49 /* 4 bytes additional padding on 64bit */
50 __u32 aalgos, ealgos, calgos, seq;
51 };
52
53 struct compat_xfrm_userspi_info {
54 struct compat_xfrm_usersa_info info;
55 /* 4 bytes additional padding on 64bit */
56 __u32 min, max;
57 };
58
59 struct compat_xfrm_user_expire {
60 struct compat_xfrm_usersa_info state;
61 /* 8 bytes additional padding on 64bit */
62 u8 hard;
63 };
64
65 struct compat_xfrm_user_polexpire {
66 struct compat_xfrm_userpolicy_info pol;
67 /* 8 bytes additional padding on 64bit */
68 u8 hard;
69 };
70
71 #define XMSGSIZE(type) sizeof(struct type)
72
73 static const int compat_msg_min[XFRM_NR_MSGTYPES] = {
74 [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_usersa_info),
75 [XFRM_MSG_DELSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
76 [XFRM_MSG_GETSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
77 [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_userpolicy_info),
78 [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
79 [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
80 [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_userspi_info),
81 [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_user_acquire),
82 [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_user_expire),
83 [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_userpolicy_info),
84 [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_usersa_info),
85 [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_user_polexpire),
86 [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush),
87 [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0,
88 [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
89 [XFRM_MSG_GETAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
90 [XFRM_MSG_REPORT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report),
91 [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
92 [XFRM_MSG_NEWSADINFO - XFRM_MSG_BASE] = sizeof(u32),
93 [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = sizeof(u32),
94 [XFRM_MSG_NEWSPDINFO - XFRM_MSG_BASE] = sizeof(u32),
95 [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = sizeof(u32),
96 [XFRM_MSG_MAPPING - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_mapping)
97 };
98
99 static const struct nla_policy compat_policy[XFRMA_MAX+1] = {
100 [XFRMA_SA] = { .len = XMSGSIZE(compat_xfrm_usersa_info)},
101 [XFRMA_POLICY] = { .len = XMSGSIZE(compat_xfrm_userpolicy_info)},
102 [XFRMA_LASTUSED] = { .type = NLA_U64},
103 [XFRMA_ALG_AUTH_TRUNC] = { .len = sizeof(struct xfrm_algo_auth)},
104 [XFRMA_ALG_AEAD] = { .len = sizeof(struct xfrm_algo_aead) },
105 [XFRMA_ALG_AUTH] = { .len = sizeof(struct xfrm_algo) },
106 [XFRMA_ALG_CRYPT] = { .len = sizeof(struct xfrm_algo) },
107 [XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) },
108 [XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) },
109 [XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) },
110 [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_sec_ctx) },
111 [XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) },
112 [XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) },
113 [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
114 [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 },
115 [XFRMA_SRCADDR] = { .len = sizeof(xfrm_address_t) },
116 [XFRMA_COADDR] = { .len = sizeof(xfrm_address_t) },
117 [XFRMA_POLICY_TYPE] = { .len = sizeof(struct xfrm_userpolicy_type)},
118 [XFRMA_MIGRATE] = { .len = sizeof(struct xfrm_user_migrate) },
119 [XFRMA_KMADDRESS] = { .len = sizeof(struct xfrm_user_kmaddress) },
120 [XFRMA_MARK] = { .len = sizeof(struct xfrm_mark) },
121 [XFRMA_TFCPAD] = { .type = NLA_U32 },
122 [XFRMA_REPLAY_ESN_VAL] = { .len = sizeof(struct xfrm_replay_state_esn) },
123 [XFRMA_SA_EXTRA_FLAGS] = { .type = NLA_U32 },
124 [XFRMA_PROTO] = { .type = NLA_U8 },
125 [XFRMA_ADDRESS_FILTER] = { .len = sizeof(struct xfrm_address_filter) },
126 [XFRMA_OFFLOAD_DEV] = { .len = sizeof(struct xfrm_user_offload) },
127 [XFRMA_SET_MARK] = { .type = NLA_U32 },
128 [XFRMA_SET_MARK_MASK] = { .type = NLA_U32 },
129 [XFRMA_IF_ID] = { .type = NLA_U32 },
130 };
131
xfrm_nlmsg_put_compat(struct sk_buff * skb,const struct nlmsghdr * nlh_src,u16 type)132 static struct nlmsghdr *xfrm_nlmsg_put_compat(struct sk_buff *skb,
133 const struct nlmsghdr *nlh_src, u16 type)
134 {
135 int payload = compat_msg_min[type];
136 int src_len = xfrm_msg_min[type];
137 struct nlmsghdr *nlh_dst;
138
139 /* Compat messages are shorter or equal to native (+padding) */
140 if (WARN_ON_ONCE(src_len < payload))
141 return ERR_PTR(-EMSGSIZE);
142
143 nlh_dst = nlmsg_put(skb, nlh_src->nlmsg_pid, nlh_src->nlmsg_seq,
144 nlh_src->nlmsg_type, payload, nlh_src->nlmsg_flags);
145 if (!nlh_dst)
146 return ERR_PTR(-EMSGSIZE);
147
148 memset(nlmsg_data(nlh_dst), 0, payload);
149
150 switch (nlh_src->nlmsg_type) {
151 /* Compat message has the same layout as native */
152 case XFRM_MSG_DELSA:
153 case XFRM_MSG_DELPOLICY:
154 case XFRM_MSG_FLUSHSA:
155 case XFRM_MSG_FLUSHPOLICY:
156 case XFRM_MSG_NEWAE:
157 case XFRM_MSG_REPORT:
158 case XFRM_MSG_MIGRATE:
159 case XFRM_MSG_NEWSADINFO:
160 case XFRM_MSG_NEWSPDINFO:
161 case XFRM_MSG_MAPPING:
162 WARN_ON_ONCE(src_len != payload);
163 memcpy(nlmsg_data(nlh_dst), nlmsg_data(nlh_src), src_len);
164 break;
165 /* 4 byte alignment for trailing u64 on native, but not on compat */
166 case XFRM_MSG_NEWSA:
167 case XFRM_MSG_NEWPOLICY:
168 case XFRM_MSG_UPDSA:
169 case XFRM_MSG_UPDPOLICY:
170 WARN_ON_ONCE(src_len != payload + 4);
171 memcpy(nlmsg_data(nlh_dst), nlmsg_data(nlh_src), payload);
172 break;
173 case XFRM_MSG_EXPIRE: {
174 const struct xfrm_user_expire *src_ue = nlmsg_data(nlh_src);
175 struct compat_xfrm_user_expire *dst_ue = nlmsg_data(nlh_dst);
176
177 /* compat_xfrm_user_expire has 4-byte smaller state */
178 memcpy(dst_ue, src_ue, sizeof(dst_ue->state));
179 dst_ue->hard = src_ue->hard;
180 break;
181 }
182 case XFRM_MSG_ACQUIRE: {
183 const struct xfrm_user_acquire *src_ua = nlmsg_data(nlh_src);
184 struct compat_xfrm_user_acquire *dst_ua = nlmsg_data(nlh_dst);
185
186 memcpy(dst_ua, src_ua, offsetof(struct compat_xfrm_user_acquire, aalgos));
187 dst_ua->aalgos = src_ua->aalgos;
188 dst_ua->ealgos = src_ua->ealgos;
189 dst_ua->calgos = src_ua->calgos;
190 dst_ua->seq = src_ua->seq;
191 break;
192 }
193 case XFRM_MSG_POLEXPIRE: {
194 const struct xfrm_user_polexpire *src_upe = nlmsg_data(nlh_src);
195 struct compat_xfrm_user_polexpire *dst_upe = nlmsg_data(nlh_dst);
196
197 /* compat_xfrm_user_polexpire has 4-byte smaller state */
198 memcpy(dst_upe, src_upe, sizeof(dst_upe->pol));
199 dst_upe->hard = src_upe->hard;
200 break;
201 }
202 case XFRM_MSG_ALLOCSPI: {
203 const struct xfrm_userspi_info *src_usi = nlmsg_data(nlh_src);
204 struct compat_xfrm_userspi_info *dst_usi = nlmsg_data(nlh_dst);
205
206 /* compat_xfrm_user_polexpire has 4-byte smaller state */
207 memcpy(dst_usi, src_usi, sizeof(src_usi->info));
208 dst_usi->min = src_usi->min;
209 dst_usi->max = src_usi->max;
210 break;
211 }
212 /* Not being sent by kernel */
213 case XFRM_MSG_GETSA:
214 case XFRM_MSG_GETPOLICY:
215 case XFRM_MSG_GETAE:
216 case XFRM_MSG_GETSADINFO:
217 case XFRM_MSG_GETSPDINFO:
218 default:
219 pr_warn_once("unsupported nlmsg_type %d\n", nlh_src->nlmsg_type);
220 return ERR_PTR(-EOPNOTSUPP);
221 }
222
223 return nlh_dst;
224 }
225
xfrm_nla_cpy(struct sk_buff * dst,const struct nlattr * src,int len)226 static int xfrm_nla_cpy(struct sk_buff *dst, const struct nlattr *src, int len)
227 {
228 return nla_put(dst, src->nla_type, len, nla_data(src));
229 }
230
xfrm_xlate64_attr(struct sk_buff * dst,const struct nlattr * src)231 static int xfrm_xlate64_attr(struct sk_buff *dst, const struct nlattr *src)
232 {
233 switch (src->nla_type) {
234 case XFRMA_PAD:
235 /* Ignore */
236 return 0;
237 case XFRMA_UNSPEC:
238 case XFRMA_ALG_AUTH:
239 case XFRMA_ALG_CRYPT:
240 case XFRMA_ALG_COMP:
241 case XFRMA_ENCAP:
242 case XFRMA_TMPL:
243 return xfrm_nla_cpy(dst, src, nla_len(src));
244 case XFRMA_SA:
245 return xfrm_nla_cpy(dst, src, XMSGSIZE(compat_xfrm_usersa_info));
246 case XFRMA_POLICY:
247 return xfrm_nla_cpy(dst, src, XMSGSIZE(compat_xfrm_userpolicy_info));
248 case XFRMA_SEC_CTX:
249 return xfrm_nla_cpy(dst, src, nla_len(src));
250 case XFRMA_LTIME_VAL:
251 return nla_put_64bit(dst, src->nla_type, nla_len(src),
252 nla_data(src), XFRMA_PAD);
253 case XFRMA_REPLAY_VAL:
254 case XFRMA_REPLAY_THRESH:
255 case XFRMA_ETIMER_THRESH:
256 case XFRMA_SRCADDR:
257 case XFRMA_COADDR:
258 return xfrm_nla_cpy(dst, src, nla_len(src));
259 case XFRMA_LASTUSED:
260 return nla_put_64bit(dst, src->nla_type, nla_len(src),
261 nla_data(src), XFRMA_PAD);
262 case XFRMA_POLICY_TYPE:
263 case XFRMA_MIGRATE:
264 case XFRMA_ALG_AEAD:
265 case XFRMA_KMADDRESS:
266 case XFRMA_ALG_AUTH_TRUNC:
267 case XFRMA_MARK:
268 case XFRMA_TFCPAD:
269 case XFRMA_REPLAY_ESN_VAL:
270 case XFRMA_SA_EXTRA_FLAGS:
271 case XFRMA_PROTO:
272 case XFRMA_ADDRESS_FILTER:
273 case XFRMA_OFFLOAD_DEV:
274 case XFRMA_SET_MARK:
275 case XFRMA_SET_MARK_MASK:
276 case XFRMA_IF_ID:
277 return xfrm_nla_cpy(dst, src, nla_len(src));
278 default:
279 BUILD_BUG_ON(XFRMA_MAX != XFRMA_IF_ID);
280 pr_warn_once("unsupported nla_type %d\n", src->nla_type);
281 return -EOPNOTSUPP;
282 }
283 }
284
285 /* Take kernel-built (64bit layout) and create 32bit layout for userspace */
xfrm_xlate64(struct sk_buff * dst,const struct nlmsghdr * nlh_src)286 static int xfrm_xlate64(struct sk_buff *dst, const struct nlmsghdr *nlh_src)
287 {
288 u16 type = nlh_src->nlmsg_type - XFRM_MSG_BASE;
289 const struct nlattr *nla, *attrs;
290 struct nlmsghdr *nlh_dst;
291 int len, remaining;
292
293 nlh_dst = xfrm_nlmsg_put_compat(dst, nlh_src, type);
294 if (IS_ERR(nlh_dst))
295 return PTR_ERR(nlh_dst);
296
297 attrs = nlmsg_attrdata(nlh_src, xfrm_msg_min[type]);
298 len = nlmsg_attrlen(nlh_src, xfrm_msg_min[type]);
299
300 nla_for_each_attr(nla, attrs, len, remaining) {
301 int err = xfrm_xlate64_attr(dst, nla);
302
303 if (err)
304 return err;
305 }
306
307 nlmsg_end(dst, nlh_dst);
308
309 return 0;
310 }
311
xfrm_alloc_compat(struct sk_buff * skb,const struct nlmsghdr * nlh_src)312 static int xfrm_alloc_compat(struct sk_buff *skb, const struct nlmsghdr *nlh_src)
313 {
314 u16 type = nlh_src->nlmsg_type - XFRM_MSG_BASE;
315 struct sk_buff *new = NULL;
316 int err;
317
318 if (type >= ARRAY_SIZE(xfrm_msg_min)) {
319 pr_warn_once("unsupported nlmsg_type %d\n", nlh_src->nlmsg_type);
320 return -EOPNOTSUPP;
321 }
322
323 if (skb_shinfo(skb)->frag_list == NULL) {
324 new = alloc_skb(skb->len + skb_tailroom(skb), GFP_ATOMIC);
325 if (!new)
326 return -ENOMEM;
327 skb_shinfo(skb)->frag_list = new;
328 }
329
330 err = xfrm_xlate64(skb_shinfo(skb)->frag_list, nlh_src);
331 if (err) {
332 if (new) {
333 kfree_skb(new);
334 skb_shinfo(skb)->frag_list = NULL;
335 }
336 return err;
337 }
338
339 return 0;
340 }
341
342 /* Calculates len of translated 64-bit message. */
xfrm_user_rcv_calculate_len64(const struct nlmsghdr * src,struct nlattr * attrs[XFRMA_MAX+1])343 static size_t xfrm_user_rcv_calculate_len64(const struct nlmsghdr *src,
344 struct nlattr *attrs[XFRMA_MAX+1])
345 {
346 size_t len = nlmsg_len(src);
347
348 switch (src->nlmsg_type) {
349 case XFRM_MSG_NEWSA:
350 case XFRM_MSG_NEWPOLICY:
351 case XFRM_MSG_ALLOCSPI:
352 case XFRM_MSG_ACQUIRE:
353 case XFRM_MSG_UPDPOLICY:
354 case XFRM_MSG_UPDSA:
355 len += 4;
356 break;
357 case XFRM_MSG_EXPIRE:
358 case XFRM_MSG_POLEXPIRE:
359 len += 8;
360 break;
361 default:
362 break;
363 }
364
365 if (attrs[XFRMA_SA])
366 len += 4;
367 if (attrs[XFRMA_POLICY])
368 len += 4;
369
370 /* XXX: some attrs may need to be realigned
371 * if !CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
372 */
373
374 return len;
375 }
376
xfrm_attr_cpy32(void * dst,size_t * pos,const struct nlattr * src,size_t size,int copy_len,int payload)377 static int xfrm_attr_cpy32(void *dst, size_t *pos, const struct nlattr *src,
378 size_t size, int copy_len, int payload)
379 {
380 struct nlmsghdr *nlmsg = dst;
381 struct nlattr *nla;
382
383 /* xfrm_user_rcv_msg_compat() relies on fact that 32-bit messages
384 * have the same len or shorted than 64-bit ones.
385 * 32-bit translation that is bigger than 64-bit original is unexpected.
386 */
387 if (WARN_ON_ONCE(copy_len > payload))
388 copy_len = payload;
389
390 if (size - *pos < nla_attr_size(payload))
391 return -ENOBUFS;
392
393 nla = dst + *pos;
394
395 memcpy(nla, src, nla_attr_size(copy_len));
396 nla->nla_len = nla_attr_size(payload);
397 *pos += nla_attr_size(copy_len);
398 nlmsg->nlmsg_len += nla->nla_len;
399
400 memset(dst + *pos, 0, payload - copy_len);
401 *pos += payload - copy_len;
402
403 return 0;
404 }
405
xfrm_xlate32_attr(void * dst,const struct nlattr * nla,size_t * pos,size_t size,struct netlink_ext_ack * extack)406 static int xfrm_xlate32_attr(void *dst, const struct nlattr *nla,
407 size_t *pos, size_t size,
408 struct netlink_ext_ack *extack)
409 {
410 int type = nla_type(nla);
411 u16 pol_len32, pol_len64;
412 int err;
413
414 if (type > XFRMA_MAX) {
415 BUILD_BUG_ON(XFRMA_MAX != XFRMA_IF_ID);
416 NL_SET_ERR_MSG(extack, "Bad attribute");
417 return -EOPNOTSUPP;
418 }
419 if (nla_len(nla) < compat_policy[type].len) {
420 NL_SET_ERR_MSG(extack, "Attribute bad length");
421 return -EOPNOTSUPP;
422 }
423
424 pol_len32 = compat_policy[type].len;
425 pol_len64 = xfrma_policy[type].len;
426
427 /* XFRMA_SA and XFRMA_POLICY - need to know how-to translate */
428 if (pol_len32 != pol_len64) {
429 if (nla_len(nla) != compat_policy[type].len) {
430 NL_SET_ERR_MSG(extack, "Attribute bad length");
431 return -EOPNOTSUPP;
432 }
433 err = xfrm_attr_cpy32(dst, pos, nla, size, pol_len32, pol_len64);
434 if (err)
435 return err;
436 }
437
438 return xfrm_attr_cpy32(dst, pos, nla, size, nla_len(nla), nla_len(nla));
439 }
440
xfrm_xlate32(struct nlmsghdr * dst,const struct nlmsghdr * src,struct nlattr * attrs[XFRMA_MAX+1],size_t size,u8 type,struct netlink_ext_ack * extack)441 static int xfrm_xlate32(struct nlmsghdr *dst, const struct nlmsghdr *src,
442 struct nlattr *attrs[XFRMA_MAX+1],
443 size_t size, u8 type, struct netlink_ext_ack *extack)
444 {
445 size_t pos;
446 int i;
447
448 memcpy(dst, src, NLMSG_HDRLEN);
449 dst->nlmsg_len = NLMSG_HDRLEN + xfrm_msg_min[type];
450 memset(nlmsg_data(dst), 0, xfrm_msg_min[type]);
451
452 switch (src->nlmsg_type) {
453 /* Compat message has the same layout as native */
454 case XFRM_MSG_DELSA:
455 case XFRM_MSG_GETSA:
456 case XFRM_MSG_DELPOLICY:
457 case XFRM_MSG_GETPOLICY:
458 case XFRM_MSG_FLUSHSA:
459 case XFRM_MSG_FLUSHPOLICY:
460 case XFRM_MSG_NEWAE:
461 case XFRM_MSG_GETAE:
462 case XFRM_MSG_REPORT:
463 case XFRM_MSG_MIGRATE:
464 case XFRM_MSG_NEWSADINFO:
465 case XFRM_MSG_GETSADINFO:
466 case XFRM_MSG_NEWSPDINFO:
467 case XFRM_MSG_GETSPDINFO:
468 case XFRM_MSG_MAPPING:
469 memcpy(nlmsg_data(dst), nlmsg_data(src), compat_msg_min[type]);
470 break;
471 /* 4 byte alignment for trailing u64 on native, but not on compat */
472 case XFRM_MSG_NEWSA:
473 case XFRM_MSG_NEWPOLICY:
474 case XFRM_MSG_UPDSA:
475 case XFRM_MSG_UPDPOLICY:
476 memcpy(nlmsg_data(dst), nlmsg_data(src), compat_msg_min[type]);
477 break;
478 case XFRM_MSG_EXPIRE: {
479 const struct compat_xfrm_user_expire *src_ue = nlmsg_data(src);
480 struct xfrm_user_expire *dst_ue = nlmsg_data(dst);
481
482 /* compat_xfrm_user_expire has 4-byte smaller state */
483 memcpy(dst_ue, src_ue, sizeof(src_ue->state));
484 dst_ue->hard = src_ue->hard;
485 break;
486 }
487 case XFRM_MSG_ACQUIRE: {
488 const struct compat_xfrm_user_acquire *src_ua = nlmsg_data(src);
489 struct xfrm_user_acquire *dst_ua = nlmsg_data(dst);
490
491 memcpy(dst_ua, src_ua, offsetof(struct compat_xfrm_user_acquire, aalgos));
492 dst_ua->aalgos = src_ua->aalgos;
493 dst_ua->ealgos = src_ua->ealgos;
494 dst_ua->calgos = src_ua->calgos;
495 dst_ua->seq = src_ua->seq;
496 break;
497 }
498 case XFRM_MSG_POLEXPIRE: {
499 const struct compat_xfrm_user_polexpire *src_upe = nlmsg_data(src);
500 struct xfrm_user_polexpire *dst_upe = nlmsg_data(dst);
501
502 /* compat_xfrm_user_polexpire has 4-byte smaller state */
503 memcpy(dst_upe, src_upe, sizeof(src_upe->pol));
504 dst_upe->hard = src_upe->hard;
505 break;
506 }
507 case XFRM_MSG_ALLOCSPI: {
508 const struct compat_xfrm_userspi_info *src_usi = nlmsg_data(src);
509 struct xfrm_userspi_info *dst_usi = nlmsg_data(dst);
510
511 /* compat_xfrm_user_polexpire has 4-byte smaller state */
512 memcpy(dst_usi, src_usi, sizeof(src_usi->info));
513 dst_usi->min = src_usi->min;
514 dst_usi->max = src_usi->max;
515 break;
516 }
517 default:
518 NL_SET_ERR_MSG(extack, "Unsupported message type");
519 return -EOPNOTSUPP;
520 }
521 pos = dst->nlmsg_len;
522
523 for (i = 1; i < XFRMA_MAX + 1; i++) {
524 int err;
525
526 if (i == XFRMA_PAD)
527 continue;
528
529 if (!attrs[i])
530 continue;
531
532 err = xfrm_xlate32_attr(dst, attrs[i], &pos, size, extack);
533 if (err)
534 return err;
535 }
536
537 return 0;
538 }
539
xfrm_user_rcv_msg_compat(const struct nlmsghdr * h32,int maxtype,const struct nla_policy * policy,struct netlink_ext_ack * extack)540 static struct nlmsghdr *xfrm_user_rcv_msg_compat(const struct nlmsghdr *h32,
541 int maxtype, const struct nla_policy *policy,
542 struct netlink_ext_ack *extack)
543 {
544 /* netlink_rcv_skb() checks if a message has full (struct nlmsghdr) */
545 u16 type = h32->nlmsg_type - XFRM_MSG_BASE;
546 struct nlattr *attrs[XFRMA_MAX+1];
547 struct nlmsghdr *h64;
548 size_t len;
549 int err;
550
551 BUILD_BUG_ON(ARRAY_SIZE(xfrm_msg_min) != ARRAY_SIZE(compat_msg_min));
552
553 if (type >= ARRAY_SIZE(xfrm_msg_min))
554 return ERR_PTR(-EINVAL);
555
556 /* Don't call parse: the message might have only nlmsg header */
557 if ((h32->nlmsg_type == XFRM_MSG_GETSA ||
558 h32->nlmsg_type == XFRM_MSG_GETPOLICY) &&
559 (h32->nlmsg_flags & NLM_F_DUMP))
560 return NULL;
561
562 err = nlmsg_parse_deprecated(h32, compat_msg_min[type], attrs,
563 maxtype ? : XFRMA_MAX, policy ? : compat_policy, extack);
564 if (err < 0)
565 return ERR_PTR(err);
566
567 len = xfrm_user_rcv_calculate_len64(h32, attrs);
568 /* The message doesn't need translation */
569 if (len == nlmsg_len(h32))
570 return NULL;
571
572 len += NLMSG_HDRLEN;
573 h64 = kvmalloc(len, GFP_KERNEL);
574 if (!h64)
575 return ERR_PTR(-ENOMEM);
576
577 err = xfrm_xlate32(h64, h32, attrs, len, type, extack);
578 if (err < 0) {
579 kvfree(h64);
580 return ERR_PTR(err);
581 }
582
583 return h64;
584 }
585
xfrm_user_policy_compat(u8 ** pdata32,int optlen)586 static int xfrm_user_policy_compat(u8 **pdata32, int optlen)
587 {
588 struct compat_xfrm_userpolicy_info *p = (void *)*pdata32;
589 u8 *src_templates, *dst_templates;
590 u8 *data64;
591
592 if (optlen < sizeof(*p))
593 return -EINVAL;
594
595 data64 = kmalloc_track_caller(optlen + 4, GFP_USER | __GFP_NOWARN);
596 if (!data64)
597 return -ENOMEM;
598
599 memcpy(data64, *pdata32, sizeof(*p));
600 memset(data64 + sizeof(*p), 0, 4);
601
602 src_templates = *pdata32 + sizeof(*p);
603 dst_templates = data64 + sizeof(*p) + 4;
604 memcpy(dst_templates, src_templates, optlen - sizeof(*p));
605
606 kfree(*pdata32);
607 *pdata32 = data64;
608 return 0;
609 }
610
611 static struct xfrm_translator xfrm_translator = {
612 .owner = THIS_MODULE,
613 .alloc_compat = xfrm_alloc_compat,
614 .rcv_msg_compat = xfrm_user_rcv_msg_compat,
615 .xlate_user_policy_sockptr = xfrm_user_policy_compat,
616 };
617
xfrm_compat_init(void)618 static int __init xfrm_compat_init(void)
619 {
620 return xfrm_register_translator(&xfrm_translator);
621 }
622
xfrm_compat_exit(void)623 static void __exit xfrm_compat_exit(void)
624 {
625 xfrm_unregister_translator(&xfrm_translator);
626 }
627
628 module_init(xfrm_compat_init);
629 module_exit(xfrm_compat_exit);
630 MODULE_LICENSE("GPL");
631 MODULE_AUTHOR("Dmitry Safonov");
632 MODULE_DESCRIPTION("XFRM 32-bit compatibility layer");
633