1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * XFRM compat layer 4 * Author: Dmitry Safonov <dima@arista.com> 5 * Based on code and translator idea by: Florian Westphal <fw@strlen.de> 6 */ 7 #include <linux/compat.h> 8 #include <linux/nospec.h> 9 #include <linux/xfrm.h> 10 #include <net/xfrm.h> 11 12 struct compat_xfrm_lifetime_cfg { 13 compat_u64 soft_byte_limit, hard_byte_limit; 14 compat_u64 soft_packet_limit, hard_packet_limit; 15 compat_u64 soft_add_expires_seconds, hard_add_expires_seconds; 16 compat_u64 soft_use_expires_seconds, hard_use_expires_seconds; 17 }; /* same size on 32bit, but only 4 byte alignment required */ 18 19 struct compat_xfrm_lifetime_cur { 20 compat_u64 bytes, packets, add_time, use_time; 21 }; /* same size on 32bit, but only 4 byte alignment required */ 22 23 struct compat_xfrm_userpolicy_info { 24 struct xfrm_selector sel; 25 struct compat_xfrm_lifetime_cfg lft; 26 struct compat_xfrm_lifetime_cur curlft; 27 __u32 priority, index; 28 u8 dir, action, flags, share; 29 /* 4 bytes additional padding on 64bit */ 30 }; 31 32 struct compat_xfrm_usersa_info { 33 struct xfrm_selector sel; 34 struct xfrm_id id; 35 xfrm_address_t saddr; 36 struct compat_xfrm_lifetime_cfg lft; 37 struct compat_xfrm_lifetime_cur curlft; 38 struct xfrm_stats stats; 39 __u32 seq, reqid; 40 u16 family; 41 u8 mode, replay_window, flags; 42 /* 4 bytes additional padding on 64bit */ 43 }; 44 45 struct compat_xfrm_user_acquire { 46 struct xfrm_id id; 47 xfrm_address_t saddr; 48 struct xfrm_selector sel; 49 struct compat_xfrm_userpolicy_info policy; 50 /* 4 bytes additional padding on 64bit */ 51 __u32 aalgos, ealgos, calgos, seq; 52 }; 53 54 struct compat_xfrm_userspi_info { 55 struct compat_xfrm_usersa_info info; 56 /* 4 bytes additional padding on 64bit */ 57 __u32 min, max; 58 }; 59 60 struct compat_xfrm_user_expire { 61 struct compat_xfrm_usersa_info state; 62 /* 8 bytes additional padding on 64bit */ 63 u8 hard; 64 }; 65 66 struct compat_xfrm_user_polexpire { 67 struct compat_xfrm_userpolicy_info pol; 68 /* 8 bytes additional padding on 64bit */ 69 u8 hard; 70 }; 71 72 #define XMSGSIZE(type) sizeof(struct type) 73 74 static const int compat_msg_min[XFRM_NR_MSGTYPES] = { 75 [XFRM_MSG_NEWSA - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_usersa_info), 76 [XFRM_MSG_DELSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id), 77 [XFRM_MSG_GETSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id), 78 [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_userpolicy_info), 79 [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id), 80 [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id), 81 [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_userspi_info), 82 [XFRM_MSG_ACQUIRE - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_user_acquire), 83 [XFRM_MSG_EXPIRE - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_user_expire), 84 [XFRM_MSG_UPDPOLICY - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_userpolicy_info), 85 [XFRM_MSG_UPDSA - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_usersa_info), 86 [XFRM_MSG_POLEXPIRE - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_user_polexpire), 87 [XFRM_MSG_FLUSHSA - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush), 88 [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0, 89 [XFRM_MSG_NEWAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id), 90 [XFRM_MSG_GETAE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id), 91 [XFRM_MSG_REPORT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report), 92 [XFRM_MSG_MIGRATE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id), 93 [XFRM_MSG_NEWSADINFO - XFRM_MSG_BASE] = sizeof(u32), 94 [XFRM_MSG_GETSADINFO - XFRM_MSG_BASE] = sizeof(u32), 95 [XFRM_MSG_NEWSPDINFO - XFRM_MSG_BASE] = sizeof(u32), 96 [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = sizeof(u32), 97 [XFRM_MSG_MAPPING - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_mapping), 98 [XFRM_MSG_MIGRATE_STATE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_migrate_state), 99 }; 100 101 static const struct nla_policy compat_policy[XFRMA_MAX+1] = { 102 [XFRMA_UNSPEC] = { .strict_start_type = XFRMA_SA_DIR }, 103 [XFRMA_SA] = { .len = XMSGSIZE(compat_xfrm_usersa_info)}, 104 [XFRMA_POLICY] = { .len = XMSGSIZE(compat_xfrm_userpolicy_info)}, 105 [XFRMA_LASTUSED] = { .type = NLA_U64}, 106 [XFRMA_ALG_AUTH_TRUNC] = { .len = sizeof(struct xfrm_algo_auth)}, 107 [XFRMA_ALG_AEAD] = { .len = sizeof(struct xfrm_algo_aead) }, 108 [XFRMA_ALG_AUTH] = { .len = sizeof(struct xfrm_algo) }, 109 [XFRMA_ALG_CRYPT] = { .len = sizeof(struct xfrm_algo) }, 110 [XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) }, 111 [XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) }, 112 [XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) }, 113 [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_user_sec_ctx) }, 114 [XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) }, 115 [XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) }, 116 [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 }, 117 [XFRMA_ETIMER_THRESH] = { .type = NLA_U32 }, 118 [XFRMA_SRCADDR] = { .len = sizeof(xfrm_address_t) }, 119 [XFRMA_COADDR] = { .len = sizeof(xfrm_address_t) }, 120 [XFRMA_POLICY_TYPE] = { .len = sizeof(struct xfrm_userpolicy_type)}, 121 [XFRMA_MIGRATE] = { .len = sizeof(struct xfrm_user_migrate) }, 122 [XFRMA_KMADDRESS] = { .len = sizeof(struct xfrm_user_kmaddress) }, 123 [XFRMA_MARK] = { .len = sizeof(struct xfrm_mark) }, 124 [XFRMA_TFCPAD] = { .type = NLA_U32 }, 125 [XFRMA_REPLAY_ESN_VAL] = { .len = sizeof(struct xfrm_replay_state_esn) }, 126 [XFRMA_SA_EXTRA_FLAGS] = { .type = NLA_U32 }, 127 [XFRMA_PROTO] = { .type = NLA_U8 }, 128 [XFRMA_ADDRESS_FILTER] = { .len = sizeof(struct xfrm_address_filter) }, 129 [XFRMA_OFFLOAD_DEV] = { .len = sizeof(struct xfrm_user_offload) }, 130 [XFRMA_SET_MARK] = { .type = NLA_U32 }, 131 [XFRMA_SET_MARK_MASK] = { .type = NLA_U32 }, 132 [XFRMA_IF_ID] = { .type = NLA_U32 }, 133 [XFRMA_MTIMER_THRESH] = { .type = NLA_U32 }, 134 [XFRMA_SA_DIR] = NLA_POLICY_RANGE(NLA_U8, XFRM_SA_DIR_IN, XFRM_SA_DIR_OUT), 135 [XFRMA_NAT_KEEPALIVE_INTERVAL] = { .type = NLA_U32 }, 136 [XFRMA_SA_PCPU] = { .type = NLA_U32 }, 137 }; 138 139 static struct nlmsghdr *xfrm_nlmsg_put_compat(struct sk_buff *skb, 140 const struct nlmsghdr *nlh_src, u16 type) 141 { 142 int payload = compat_msg_min[type]; 143 int src_len = xfrm_msg_min[type]; 144 struct nlmsghdr *nlh_dst; 145 146 /* Compat messages are shorter or equal to native (+padding) */ 147 if (WARN_ON_ONCE(src_len < payload)) 148 return ERR_PTR(-EMSGSIZE); 149 150 nlh_dst = nlmsg_put(skb, nlh_src->nlmsg_pid, nlh_src->nlmsg_seq, 151 nlh_src->nlmsg_type, payload, nlh_src->nlmsg_flags); 152 if (!nlh_dst) 153 return ERR_PTR(-EMSGSIZE); 154 155 memset(nlmsg_data(nlh_dst), 0, payload); 156 157 switch (nlh_src->nlmsg_type) { 158 /* Compat message has the same layout as native */ 159 case XFRM_MSG_DELSA: 160 case XFRM_MSG_DELPOLICY: 161 case XFRM_MSG_FLUSHSA: 162 case XFRM_MSG_FLUSHPOLICY: 163 case XFRM_MSG_NEWAE: 164 case XFRM_MSG_REPORT: 165 case XFRM_MSG_MIGRATE: 166 case XFRM_MSG_MIGRATE_STATE: 167 case XFRM_MSG_NEWSADINFO: 168 case XFRM_MSG_NEWSPDINFO: 169 case XFRM_MSG_MAPPING: 170 WARN_ON_ONCE(src_len != payload); 171 memcpy(nlmsg_data(nlh_dst), nlmsg_data(nlh_src), src_len); 172 break; 173 /* 4 byte alignment for trailing u64 on native, but not on compat */ 174 case XFRM_MSG_NEWSA: 175 case XFRM_MSG_NEWPOLICY: 176 case XFRM_MSG_UPDSA: 177 case XFRM_MSG_UPDPOLICY: 178 WARN_ON_ONCE(src_len != payload + 4); 179 memcpy(nlmsg_data(nlh_dst), nlmsg_data(nlh_src), payload); 180 break; 181 case XFRM_MSG_EXPIRE: { 182 const struct xfrm_user_expire *src_ue = nlmsg_data(nlh_src); 183 struct compat_xfrm_user_expire *dst_ue = nlmsg_data(nlh_dst); 184 185 /* compat_xfrm_user_expire has 4-byte smaller state */ 186 memcpy(dst_ue, src_ue, sizeof(dst_ue->state)); 187 dst_ue->hard = src_ue->hard; 188 break; 189 } 190 case XFRM_MSG_ACQUIRE: { 191 const struct xfrm_user_acquire *src_ua = nlmsg_data(nlh_src); 192 struct compat_xfrm_user_acquire *dst_ua = nlmsg_data(nlh_dst); 193 194 memcpy(dst_ua, src_ua, offsetof(struct compat_xfrm_user_acquire, aalgos)); 195 dst_ua->aalgos = src_ua->aalgos; 196 dst_ua->ealgos = src_ua->ealgos; 197 dst_ua->calgos = src_ua->calgos; 198 dst_ua->seq = src_ua->seq; 199 break; 200 } 201 case XFRM_MSG_POLEXPIRE: { 202 const struct xfrm_user_polexpire *src_upe = nlmsg_data(nlh_src); 203 struct compat_xfrm_user_polexpire *dst_upe = nlmsg_data(nlh_dst); 204 205 /* compat_xfrm_user_polexpire has 4-byte smaller state */ 206 memcpy(dst_upe, src_upe, sizeof(dst_upe->pol)); 207 dst_upe->hard = src_upe->hard; 208 break; 209 } 210 case XFRM_MSG_ALLOCSPI: { 211 const struct xfrm_userspi_info *src_usi = nlmsg_data(nlh_src); 212 struct compat_xfrm_userspi_info *dst_usi = nlmsg_data(nlh_dst); 213 214 /* compat_xfrm_user_polexpire has 4-byte smaller state */ 215 memcpy(dst_usi, src_usi, sizeof(src_usi->info)); 216 dst_usi->min = src_usi->min; 217 dst_usi->max = src_usi->max; 218 break; 219 } 220 /* Not being sent by kernel */ 221 case XFRM_MSG_GETSA: 222 case XFRM_MSG_GETPOLICY: 223 case XFRM_MSG_GETAE: 224 case XFRM_MSG_GETSADINFO: 225 case XFRM_MSG_GETSPDINFO: 226 default: 227 pr_warn_once("unsupported nlmsg_type %d\n", nlh_src->nlmsg_type); 228 return ERR_PTR(-EOPNOTSUPP); 229 } 230 231 return nlh_dst; 232 } 233 234 static int xfrm_nla_cpy(struct sk_buff *dst, const struct nlattr *src, int len) 235 { 236 return nla_put(dst, src->nla_type, len, nla_data(src)); 237 } 238 239 static int xfrm_xlate64_attr(struct sk_buff *dst, const struct nlattr *src) 240 { 241 switch (src->nla_type) { 242 case XFRMA_PAD: 243 /* Ignore */ 244 return 0; 245 case XFRMA_UNSPEC: 246 case XFRMA_ALG_AUTH: 247 case XFRMA_ALG_CRYPT: 248 case XFRMA_ALG_COMP: 249 case XFRMA_ENCAP: 250 case XFRMA_TMPL: 251 return xfrm_nla_cpy(dst, src, nla_len(src)); 252 case XFRMA_SA: 253 return xfrm_nla_cpy(dst, src, XMSGSIZE(compat_xfrm_usersa_info)); 254 case XFRMA_POLICY: 255 return xfrm_nla_cpy(dst, src, XMSGSIZE(compat_xfrm_userpolicy_info)); 256 case XFRMA_SEC_CTX: 257 return xfrm_nla_cpy(dst, src, nla_len(src)); 258 case XFRMA_LTIME_VAL: 259 return nla_put_64bit(dst, src->nla_type, nla_len(src), 260 nla_data(src), XFRMA_PAD); 261 case XFRMA_REPLAY_VAL: 262 case XFRMA_REPLAY_THRESH: 263 case XFRMA_ETIMER_THRESH: 264 case XFRMA_SRCADDR: 265 case XFRMA_COADDR: 266 return xfrm_nla_cpy(dst, src, nla_len(src)); 267 case XFRMA_LASTUSED: 268 return nla_put_64bit(dst, src->nla_type, nla_len(src), 269 nla_data(src), XFRMA_PAD); 270 case XFRMA_POLICY_TYPE: 271 case XFRMA_MIGRATE: 272 case XFRMA_ALG_AEAD: 273 case XFRMA_KMADDRESS: 274 case XFRMA_ALG_AUTH_TRUNC: 275 case XFRMA_MARK: 276 case XFRMA_TFCPAD: 277 case XFRMA_REPLAY_ESN_VAL: 278 case XFRMA_SA_EXTRA_FLAGS: 279 case XFRMA_PROTO: 280 case XFRMA_ADDRESS_FILTER: 281 case XFRMA_OFFLOAD_DEV: 282 case XFRMA_SET_MARK: 283 case XFRMA_SET_MARK_MASK: 284 case XFRMA_IF_ID: 285 case XFRMA_MTIMER_THRESH: 286 case XFRMA_SA_DIR: 287 case XFRMA_NAT_KEEPALIVE_INTERVAL: 288 case XFRMA_SA_PCPU: 289 case XFRMA_IPTFS_DROP_TIME: 290 case XFRMA_IPTFS_REORDER_WINDOW: 291 case XFRMA_IPTFS_DONT_FRAG: 292 case XFRMA_IPTFS_INIT_DELAY: 293 case XFRMA_IPTFS_MAX_QSIZE: 294 case XFRMA_IPTFS_PKT_SIZE: 295 return xfrm_nla_cpy(dst, src, nla_len(src)); 296 default: 297 BUILD_BUG_ON(XFRMA_MAX != XFRMA_IPTFS_PKT_SIZE); 298 pr_warn_once("unsupported nla_type %d\n", src->nla_type); 299 return -EOPNOTSUPP; 300 } 301 } 302 303 /* Take kernel-built (64bit layout) and create 32bit layout for userspace */ 304 static int xfrm_xlate64(struct sk_buff *dst, const struct nlmsghdr *nlh_src) 305 { 306 u16 type = nlh_src->nlmsg_type - XFRM_MSG_BASE; 307 const struct nlattr *nla, *attrs; 308 struct nlmsghdr *nlh_dst; 309 int len, remaining; 310 311 nlh_dst = xfrm_nlmsg_put_compat(dst, nlh_src, type); 312 if (IS_ERR(nlh_dst)) 313 return PTR_ERR(nlh_dst); 314 315 attrs = nlmsg_attrdata(nlh_src, xfrm_msg_min[type]); 316 len = nlmsg_attrlen(nlh_src, xfrm_msg_min[type]); 317 318 nla_for_each_attr(nla, attrs, len, remaining) { 319 int err; 320 321 switch (nlh_src->nlmsg_type) { 322 case XFRM_MSG_NEWSPDINFO: 323 err = xfrm_nla_cpy(dst, nla, nla_len(nla)); 324 break; 325 default: 326 err = xfrm_xlate64_attr(dst, nla); 327 break; 328 } 329 if (err) 330 return err; 331 } 332 333 nlmsg_end(dst, nlh_dst); 334 335 return 0; 336 } 337 338 static int xfrm_alloc_compat(struct sk_buff *skb, const struct nlmsghdr *nlh_src) 339 { 340 u16 type = nlh_src->nlmsg_type - XFRM_MSG_BASE; 341 struct sk_buff *new = NULL; 342 int err; 343 344 if (type >= ARRAY_SIZE(xfrm_msg_min)) { 345 pr_warn_once("unsupported nlmsg_type %d\n", nlh_src->nlmsg_type); 346 return -EOPNOTSUPP; 347 } 348 349 if (skb_shinfo(skb)->frag_list == NULL) { 350 new = alloc_skb(skb->len + skb_tailroom(skb), GFP_ATOMIC); 351 if (!new) 352 return -ENOMEM; 353 skb_shinfo(skb)->frag_list = new; 354 } 355 356 err = xfrm_xlate64(skb_shinfo(skb)->frag_list, nlh_src); 357 if (err) { 358 if (new) { 359 kfree_skb(new); 360 skb_shinfo(skb)->frag_list = NULL; 361 } 362 return err; 363 } 364 365 return 0; 366 } 367 368 /* Calculates len of translated 64-bit message. */ 369 static size_t xfrm_user_rcv_calculate_len64(const struct nlmsghdr *src, 370 struct nlattr *attrs[XFRMA_MAX + 1], 371 int maxtype) 372 { 373 size_t len = nlmsg_len(src); 374 375 switch (src->nlmsg_type) { 376 case XFRM_MSG_NEWSA: 377 case XFRM_MSG_NEWPOLICY: 378 case XFRM_MSG_ALLOCSPI: 379 case XFRM_MSG_ACQUIRE: 380 case XFRM_MSG_UPDPOLICY: 381 case XFRM_MSG_UPDSA: 382 len += 4; 383 break; 384 case XFRM_MSG_EXPIRE: 385 case XFRM_MSG_POLEXPIRE: 386 len += 8; 387 break; 388 case XFRM_MSG_NEWSPDINFO: 389 /* attirbutes are xfrm_spdattr_type_t, not xfrm_attr_type_t */ 390 return len; 391 default: 392 break; 393 } 394 395 /* Unexpected for anything, but XFRM_MSG_NEWSPDINFO, please 396 * correct both 64=>32-bit and 32=>64-bit translators to copy 397 * new attributes. 398 */ 399 if (WARN_ON_ONCE(maxtype)) 400 return len; 401 402 if (attrs[XFRMA_SA]) 403 len += 4; 404 if (attrs[XFRMA_POLICY]) 405 len += 4; 406 407 /* XXX: some attrs may need to be realigned 408 * if !CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 409 */ 410 411 return len; 412 } 413 414 static int xfrm_attr_cpy32(void *dst, size_t *pos, const struct nlattr *src, 415 size_t size, int copy_len, int payload) 416 { 417 struct nlmsghdr *nlmsg = dst; 418 struct nlattr *nla; 419 420 /* xfrm_user_rcv_msg_compat() relies on fact that 32-bit messages 421 * have the same len or shorted than 64-bit ones. 422 * 32-bit translation that is bigger than 64-bit original is unexpected. 423 */ 424 if (WARN_ON_ONCE(copy_len > payload)) 425 copy_len = payload; 426 427 if (size - *pos < nla_attr_size(payload)) 428 return -ENOBUFS; 429 430 nla = dst + *pos; 431 432 memcpy(nla, src, nla_attr_size(copy_len)); 433 nla->nla_len = nla_attr_size(payload); 434 *pos += nla_attr_size(copy_len); 435 nlmsg->nlmsg_len += nla->nla_len; 436 437 memset(dst + *pos, 0, payload - copy_len); 438 *pos += payload - copy_len; 439 440 return 0; 441 } 442 443 static int xfrm_xlate32_attr(void *dst, const struct nlattr *nla, 444 size_t *pos, size_t size, 445 struct netlink_ext_ack *extack) 446 { 447 int type = nla_type(nla); 448 u16 pol_len32, pol_len64; 449 int err; 450 451 if (type > XFRMA_MAX) { 452 BUILD_BUG_ON(XFRMA_MAX != XFRMA_IPTFS_PKT_SIZE); 453 NL_SET_ERR_MSG(extack, "Bad attribute"); 454 return -EOPNOTSUPP; 455 } 456 type = array_index_nospec(type, XFRMA_MAX + 1); 457 if (nla_len(nla) < compat_policy[type].len) { 458 NL_SET_ERR_MSG(extack, "Attribute bad length"); 459 return -EOPNOTSUPP; 460 } 461 462 pol_len32 = compat_policy[type].len; 463 pol_len64 = xfrma_policy[type].len; 464 465 /* XFRMA_SA and XFRMA_POLICY - need to know how-to translate */ 466 if (pol_len32 != pol_len64) { 467 if (nla_len(nla) != compat_policy[type].len) { 468 NL_SET_ERR_MSG(extack, "Attribute bad length"); 469 return -EOPNOTSUPP; 470 } 471 err = xfrm_attr_cpy32(dst, pos, nla, size, pol_len32, pol_len64); 472 if (err) 473 return err; 474 } 475 476 return xfrm_attr_cpy32(dst, pos, nla, size, nla_len(nla), nla_len(nla)); 477 } 478 479 static int xfrm_xlate32(struct nlmsghdr *dst, const struct nlmsghdr *src, 480 struct nlattr *attrs[XFRMA_MAX+1], 481 size_t size, u8 type, int maxtype, 482 struct netlink_ext_ack *extack) 483 { 484 size_t pos; 485 int i; 486 487 memcpy(dst, src, NLMSG_HDRLEN); 488 dst->nlmsg_len = NLMSG_HDRLEN + xfrm_msg_min[type]; 489 memset(nlmsg_data(dst), 0, xfrm_msg_min[type]); 490 491 switch (src->nlmsg_type) { 492 /* Compat message has the same layout as native */ 493 case XFRM_MSG_DELSA: 494 case XFRM_MSG_GETSA: 495 case XFRM_MSG_DELPOLICY: 496 case XFRM_MSG_GETPOLICY: 497 case XFRM_MSG_FLUSHSA: 498 case XFRM_MSG_FLUSHPOLICY: 499 case XFRM_MSG_NEWAE: 500 case XFRM_MSG_GETAE: 501 case XFRM_MSG_REPORT: 502 case XFRM_MSG_MIGRATE: 503 case XFRM_MSG_MIGRATE_STATE: 504 case XFRM_MSG_NEWSADINFO: 505 case XFRM_MSG_GETSADINFO: 506 case XFRM_MSG_NEWSPDINFO: 507 case XFRM_MSG_GETSPDINFO: 508 case XFRM_MSG_MAPPING: 509 memcpy(nlmsg_data(dst), nlmsg_data(src), compat_msg_min[type]); 510 break; 511 /* 4 byte alignment for trailing u64 on native, but not on compat */ 512 case XFRM_MSG_NEWSA: 513 case XFRM_MSG_NEWPOLICY: 514 case XFRM_MSG_UPDSA: 515 case XFRM_MSG_UPDPOLICY: 516 memcpy(nlmsg_data(dst), nlmsg_data(src), compat_msg_min[type]); 517 break; 518 case XFRM_MSG_EXPIRE: { 519 const struct compat_xfrm_user_expire *src_ue = nlmsg_data(src); 520 struct xfrm_user_expire *dst_ue = nlmsg_data(dst); 521 522 /* compat_xfrm_user_expire has 4-byte smaller state */ 523 memcpy(dst_ue, src_ue, sizeof(src_ue->state)); 524 dst_ue->hard = src_ue->hard; 525 break; 526 } 527 case XFRM_MSG_ACQUIRE: { 528 const struct compat_xfrm_user_acquire *src_ua = nlmsg_data(src); 529 struct xfrm_user_acquire *dst_ua = nlmsg_data(dst); 530 531 memcpy(dst_ua, src_ua, offsetof(struct compat_xfrm_user_acquire, aalgos)); 532 dst_ua->aalgos = src_ua->aalgos; 533 dst_ua->ealgos = src_ua->ealgos; 534 dst_ua->calgos = src_ua->calgos; 535 dst_ua->seq = src_ua->seq; 536 break; 537 } 538 case XFRM_MSG_POLEXPIRE: { 539 const struct compat_xfrm_user_polexpire *src_upe = nlmsg_data(src); 540 struct xfrm_user_polexpire *dst_upe = nlmsg_data(dst); 541 542 /* compat_xfrm_user_polexpire has 4-byte smaller state */ 543 memcpy(dst_upe, src_upe, sizeof(src_upe->pol)); 544 dst_upe->hard = src_upe->hard; 545 break; 546 } 547 case XFRM_MSG_ALLOCSPI: { 548 const struct compat_xfrm_userspi_info *src_usi = nlmsg_data(src); 549 struct xfrm_userspi_info *dst_usi = nlmsg_data(dst); 550 551 /* compat_xfrm_user_polexpire has 4-byte smaller state */ 552 memcpy(dst_usi, src_usi, sizeof(src_usi->info)); 553 dst_usi->min = src_usi->min; 554 dst_usi->max = src_usi->max; 555 break; 556 } 557 default: 558 NL_SET_ERR_MSG(extack, "Unsupported message type"); 559 return -EOPNOTSUPP; 560 } 561 pos = dst->nlmsg_len; 562 563 if (maxtype) { 564 /* attirbutes are xfrm_spdattr_type_t, not xfrm_attr_type_t */ 565 WARN_ON_ONCE(src->nlmsg_type != XFRM_MSG_NEWSPDINFO); 566 567 for (i = 1; i <= maxtype; i++) { 568 int err; 569 570 if (!attrs[i]) 571 continue; 572 573 /* just copy - no need for translation */ 574 err = xfrm_attr_cpy32(dst, &pos, attrs[i], size, 575 nla_len(attrs[i]), nla_len(attrs[i])); 576 if (err) 577 return err; 578 } 579 return 0; 580 } 581 582 for (i = 1; i < XFRMA_MAX + 1; i++) { 583 int err; 584 585 if (i == XFRMA_PAD) 586 continue; 587 588 if (!attrs[i]) 589 continue; 590 591 err = xfrm_xlate32_attr(dst, attrs[i], &pos, size, extack); 592 if (err) 593 return err; 594 } 595 596 return 0; 597 } 598 599 static struct nlmsghdr *xfrm_user_rcv_msg_compat(const struct nlmsghdr *h32, 600 int maxtype, const struct nla_policy *policy, 601 struct netlink_ext_ack *extack) 602 { 603 /* netlink_rcv_skb() checks if a message has full (struct nlmsghdr) */ 604 u16 type = h32->nlmsg_type - XFRM_MSG_BASE; 605 struct nlattr *attrs[XFRMA_MAX+1]; 606 struct nlmsghdr *h64; 607 size_t len; 608 int err; 609 610 BUILD_BUG_ON(ARRAY_SIZE(xfrm_msg_min) != ARRAY_SIZE(compat_msg_min)); 611 612 if (type >= ARRAY_SIZE(xfrm_msg_min)) 613 return ERR_PTR(-EINVAL); 614 615 /* Don't call parse: the message might have only nlmsg header */ 616 if ((h32->nlmsg_type == XFRM_MSG_GETSA || 617 h32->nlmsg_type == XFRM_MSG_GETPOLICY) && 618 (h32->nlmsg_flags & NLM_F_DUMP)) 619 return NULL; 620 621 err = nlmsg_parse_deprecated(h32, compat_msg_min[type], attrs, 622 maxtype ? : XFRMA_MAX, policy ? : compat_policy, extack); 623 if (err < 0) 624 return ERR_PTR(err); 625 626 len = xfrm_user_rcv_calculate_len64(h32, attrs, maxtype); 627 /* The message doesn't need translation */ 628 if (len == nlmsg_len(h32)) 629 return NULL; 630 631 len += NLMSG_HDRLEN; 632 h64 = kvmalloc(len, GFP_KERNEL); 633 if (!h64) 634 return ERR_PTR(-ENOMEM); 635 636 err = xfrm_xlate32(h64, h32, attrs, len, type, maxtype, extack); 637 if (err < 0) { 638 kvfree(h64); 639 return ERR_PTR(err); 640 } 641 642 return h64; 643 } 644 645 static int xfrm_user_policy_compat(u8 **pdata32, int optlen) 646 { 647 struct compat_xfrm_userpolicy_info *p = (void *)*pdata32; 648 u8 *src_templates, *dst_templates; 649 u8 *data64; 650 651 if (optlen < sizeof(*p)) 652 return -EINVAL; 653 654 data64 = kmalloc_track_caller(optlen + 4, GFP_USER | __GFP_NOWARN); 655 if (!data64) 656 return -ENOMEM; 657 658 memcpy(data64, *pdata32, sizeof(*p)); 659 memset(data64 + sizeof(*p), 0, 4); 660 661 src_templates = *pdata32 + sizeof(*p); 662 dst_templates = data64 + sizeof(*p) + 4; 663 memcpy(dst_templates, src_templates, optlen - sizeof(*p)); 664 665 kfree(*pdata32); 666 *pdata32 = data64; 667 return 0; 668 } 669 670 static struct xfrm_translator xfrm_translator = { 671 .owner = THIS_MODULE, 672 .alloc_compat = xfrm_alloc_compat, 673 .rcv_msg_compat = xfrm_user_rcv_msg_compat, 674 .xlate_user_policy_sockptr = xfrm_user_policy_compat, 675 }; 676 677 static int __init xfrm_compat_init(void) 678 { 679 return xfrm_register_translator(&xfrm_translator); 680 } 681 682 static void __exit xfrm_compat_exit(void) 683 { 684 xfrm_unregister_translator(&xfrm_translator); 685 } 686 687 module_init(xfrm_compat_init); 688 module_exit(xfrm_compat_exit); 689 MODULE_LICENSE("GPL"); 690 MODULE_AUTHOR("Dmitry Safonov"); 691 MODULE_DESCRIPTION("XFRM 32-bit compatibility layer"); 692