From patchwork Tue Jul 13 07:29:42 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Timo Teras X-Patchwork-Id: 58715 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id BA949B6EEE for ; Tue, 13 Jul 2010 17:30:31 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752788Ab0GMHa0 (ORCPT ); Tue, 13 Jul 2010 03:30:26 -0400 Received: from mail-ew0-f46.google.com ([209.85.215.46]:48931 "EHLO mail-ew0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752414Ab0GMHaZ (ORCPT ); Tue, 13 Jul 2010 03:30:25 -0400 Received: by ewy23 with SMTP id 23so1014696ewy.19 for ; Tue, 13 Jul 2010 00:30:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:sender:from:to:cc:subject :date:message-id:x-mailer:in-reply-to:references:mime-version :content-type:content-transfer-encoding; bh=NI/myQyLtKcgcwT+Kp0miHi/lLkWO1iLSlJNayT61IE=; b=sqgss4vRkxI2AhmNDKPdxO5/Jy/sNVV7hRTV/MPuAx7uDLiYwlrk5xkNPKtjsApaMQ G8TfrZOYyhpV6beLPZkBgtdgiwhfCSMK3uc4tCSyzvrCcO4PMsXdwJ0pNCuapiYVMix/ bMBpP6F55uoaORN5KS3/fYRfNnKJ34pCLwXQc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=sender:from:to:cc:subject:date:message-id:x-mailer:in-reply-to :references:mime-version:content-type:content-transfer-encoding; b=rvptNAB98K5Obmwet58CGABCfu+KBp3GcHEH3c+vamrOx4ksj641Lqs9gn5/qP1akn jXjVUoF3LSk4XuGoOQiYY+HjFMXNmfpbRsEcimSWf+UYQXh2Z3oEqlolVHbph558tiOf 1gSzq0IwRMj9EKUW5dgR265wc4Eb0ZQLi4pQI= Received: by 10.213.31.140 with SMTP id y12mr10753427ebc.26.1279006222923; Tue, 13 Jul 2010 00:30:22 -0700 (PDT) Received: from localhost.localdomain (letku109.adsl.netsonic.fi [194.29.195.109]) by mx.google.com with ESMTPS id z55sm44681680eeh.15.2010.07.13.00.30.21 (version=SSLv3 cipher=RC4-MD5); Tue, 13 Jul 2010 00:30:21 -0700 (PDT) From: =?UTF-8?q?Timo=20Ter=C3=A4s?= To: netdev@vger.kernel.org, David Miller , linux@horizon.com Cc: =?UTF-8?q?Timo=20Ter=C3=A4s?= Subject: [PATCH] xfrm: do not assume that template resolving always returns xfrms Date: Tue, 13 Jul 2010 10:29:42 +0300 Message-Id: <1279006182-11421-1-git-send-email-timo.teras@iki.fi> X-Mailer: git-send-email 1.7.0.4 In-Reply-To: <20100712.212041.236240543.davem@davemloft.net> References: <20100712.212041.236240543.davem@davemloft.net> MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org xfrm_resolve_and_create_bundle() assumed that, if policies indicated presence of xfrms, bundle template resolution would always return some xfrms. This is not true for 'use' level policies which can result in no xfrm's being applied if there is no suitable xfrm states. This fixes a crash by this incorrect assumption. Reported-by: George Spelvin Bisected-by: George Spelvin Tested-by: George Spelvin Signed-off-by: Timo Teräs --- net/xfrm/xfrm_policy.c | 15 +++++++++++++-- 1 files changed, 13 insertions(+), 2 deletions(-) diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index af1c173..a7ec5a8 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -1594,8 +1594,8 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols, /* Try to instantiate a bundle */ err = xfrm_tmpl_resolve(pols, num_pols, fl, xfrm, family); - if (err < 0) { - if (err != -EAGAIN) + if (err <= 0) { + if (err != 0 && err != -EAGAIN) XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR); return ERR_PTR(err); } @@ -1678,6 +1678,13 @@ xfrm_bundle_lookup(struct net *net, struct flowi *fl, u16 family, u8 dir, goto make_dummy_bundle; dst_hold(&xdst->u.dst); return oldflo; + } else if (new_xdst == NULL) { + num_xfrms = 0; + if (oldflo == NULL) + goto make_dummy_bundle; + xdst->num_xfrms = 0; + dst_hold(&xdst->u.dst); + return oldflo; } /* Kill the previous bundle */ @@ -1760,6 +1767,10 @@ restart: xfrm_pols_put(pols, num_pols); err = PTR_ERR(xdst); goto dropdst; + } else if (xdst == NULL) { + num_xfrms = 0; + drop_pols = num_pols; + goto no_transform; } spin_lock_bh(&xfrm_policy_sk_bundle_lock);