pull request (net-next): ipsec-next 2015-04-09

pull request (net-next): ipsec-next 2015-04-09

[Steffen Klassert]

1) Prohibit the use/abuse of the xfrm netlink interface on
   32/64 bit compatibility tasks. We need a full compat
   layer before we can allow this. From Fan Du.

Please pull or let me know if there are problems.

Thanks!

The following changes since commit b898441f4ece44933af90b116b467f7864dd1ae7:

  Merge branch 'neigh_cleanups' (2015-03-02 16:43:46 -0500)

are available in the git repository at:


  git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git master

for you to fetch changes up to 74005991b78a0a7a6546004fb37d33a651c613e7:

  xfrm: Do not parse 32bits compiled xfrm netlink msg on 64bits host (2015-03-03 10:10:16 +0100)

----------------------------------------------------------------
Fan Du (1):
      xfrm: Do not parse 32bits compiled xfrm netlink msg on 64bits host

 net/xfrm/xfrm_user.c | 5 +++++
 1 file changed, 5 insertions(+)

[PATCH] xfrm: Do not parse 32bits compiled xfrm netlink msg on 64bits host

[Steffen Klassert]

From: Fan Du <fan.du@intel.com>

structure like xfrm_usersa_info or xfrm_userpolicy_info
has different sizeof when compiled as 32bits and 64bits
due to not appending pack attribute in their definition.
This will result in broken SA and SP information when user
trying to configure them through netlink interface.

Inform user land about this situation instead of keeping
silent, the upper test scripts would behave accordingly.

Signed-off-by: Fan Du <fan.du@intel.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
 net/xfrm/xfrm_user.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 7de2ed9..2091664 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2423,6 +2423,11 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 	const struct xfrm_link *link;
 	int type, err;
 
+#ifdef CONFIG_COMPAT
+	if (is_compat_task())
+		return -ENOTSUPP;
+#endif
+
 	type = nlh->nlmsg_type;
 	if (type > XFRM_MSG_MAX)
 		return -EINVAL;
-- 
1.9.1

Re: pull request (net-next): ipsec-next 2015-04-09

[David Miller]

From: Steffen Klassert <steffen.klassert@secunet.com>
Date: Thu, 9 Apr 2015 12:33:07 +0200

> 1) Prohibit the use/abuse of the xfrm netlink interface on
>    32/64 bit compatibility tasks. We need a full compat
>    layer before we can allow this. From Fan Du.
> 
> Please pull or let me know if there are problems.

Pulled, thanks Steffen.

This is fine as a short term fix, but long term we should translate these data
structures.