Commit 57010b8e authored by Herbert Xu's avatar Herbert Xu Committed by Steffen Klassert
Browse files

xfrm: Silence warnings triggerable by bad packets 



After the elimination of inner modes, a couple of warnings that
were previously unreachable can now be triggered by malformed
inbound packets.

Fix this by:

1. Moving the setting of skb->protocol into the decap functions.
2. Returning -EINVAL when unexpected protocol is seen.

Reported-by: default avatarMaciej <Żenczykowski&lt;maze@google.com>
Fixes: 5f24f41e ("xfrm: Remove inner/outer modes from input path")
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Reviewed-by: default avatarMaciej Żenczykowski <maze@google.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent d1e0e61d

net/xfrm/xfrm_input.c

+9 −13
Original line number Diff line number Diff line
@@ -180,6 +180,8 @@ static int xfrm4_remove_beet_encap(struct xfrm_state *x, struct sk_buff *skb) 
	int optlen = 0;

	int err = -EINVAL;



	skb->protocol = htons(ETH_P_IP);



	if (unlikely(XFRM_MODE_SKB_CB(skb)->protocol == IPPROTO_BEETPH)) {

		struct ip_beet_phdr *ph;

		int phlen;
@@ -232,6 +234,8 @@ static int xfrm4_remove_tunnel_encap(struct xfrm_state *x, struct sk_buff *skb) 
{

	int err = -EINVAL;



	skb->protocol = htons(ETH_P_IP);



	if (!pskb_may_pull(skb, sizeof(struct iphdr)))

		goto out;
@@ -267,6 +271,8 @@ static int xfrm6_remove_tunnel_encap(struct xfrm_state *x, struct sk_buff *skb) 
{

	int err = -EINVAL;



	skb->protocol = htons(ETH_P_IPV6);



	if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))

		goto out;
@@ -296,6 +302,8 @@ static int xfrm6_remove_beet_encap(struct xfrm_state *x, struct sk_buff *skb) 
	int size = sizeof(struct ipv6hdr);

	int err;



	skb->protocol = htons(ETH_P_IPV6);



	err = skb_cow_head(skb, size + skb->mac_len);

	if (err)

		goto out;
@@ -346,6 +354,7 @@ xfrm_inner_mode_encap_remove(struct xfrm_state *x, 
			return xfrm6_remove_tunnel_encap(x, skb);

		break;

		}

		return -EINVAL;

	}



	WARN_ON_ONCE(1);
@@ -366,19 +375,6 @@ static int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb) 
		return -EAFNOSUPPORT;

	}



	switch (XFRM_MODE_SKB_CB(skb)->protocol) {

	case IPPROTO_IPIP:

	case IPPROTO_BEETPH:

		skb->protocol = htons(ETH_P_IP);

		break;

	case IPPROTO_IPV6:

		skb->protocol = htons(ETH_P_IPV6);

		break;

	default:

		WARN_ON_ONCE(1);

		break;

	}



	return xfrm_inner_mode_encap_remove(x, skb);

}