xref: /openbmc/linux/net/xfrm/xfrm_compat.c (revision d1e0e61d)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * XFRM compat layer
4  * Author: Dmitry Safonov <dima@arista.com>
5  * Based on code and translator idea by: Florian Westphal <fw@strlen.de>
6  */
7 #include <linux/compat.h>
8 #include <linux/nospec.h>
9 #include <linux/xfrm.h>
10 #include <net/xfrm.h>
11 
12 struct compat_xfrm_lifetime_cfg {
13 	compat_u64 soft_byte_limit, hard_byte_limit;
14 	compat_u64 soft_packet_limit, hard_packet_limit;
15 	compat_u64 soft_add_expires_seconds, hard_add_expires_seconds;
16 	compat_u64 soft_use_expires_seconds, hard_use_expires_seconds;
17 }; /* same size on 32bit, but only 4 byte alignment required */
18 
19 struct compat_xfrm_lifetime_cur {
20 	compat_u64 bytes, packets, add_time, use_time;
21 }; /* same size on 32bit, but only 4 byte alignment required */
22 
23 struct compat_xfrm_userpolicy_info {
24 	struct xfrm_selector sel;
25 	struct compat_xfrm_lifetime_cfg lft;
26 	struct compat_xfrm_lifetime_cur curlft;
27 	__u32 priority, index;
28 	u8 dir, action, flags, share;
29 	/* 4 bytes additional padding on 64bit */
30 };
31 
32 struct compat_xfrm_usersa_info {
33 	struct xfrm_selector sel;
34 	struct xfrm_id id;
35 	xfrm_address_t saddr;
36 	struct compat_xfrm_lifetime_cfg lft;
37 	struct compat_xfrm_lifetime_cur curlft;
38 	struct xfrm_stats stats;
39 	__u32 seq, reqid;
40 	u16 family;
41 	u8 mode, replay_window, flags;
42 	/* 4 bytes additional padding on 64bit */
43 };
44 
45 struct compat_xfrm_user_acquire {
46 	struct xfrm_id id;
47 	xfrm_address_t saddr;
48 	struct xfrm_selector sel;
49 	struct compat_xfrm_userpolicy_info policy;
50 	/* 4 bytes additional padding on 64bit */
51 	__u32 aalgos, ealgos, calgos, seq;
52 };
53 
54 struct compat_xfrm_userspi_info {
55 	struct compat_xfrm_usersa_info info;
56 	/* 4 bytes additional padding on 64bit */
57 	__u32 min, max;
58 };
59 
60 struct compat_xfrm_user_expire {
61 	struct compat_xfrm_usersa_info state;
62 	/* 8 bytes additional padding on 64bit */
63 	u8 hard;
64 };
65 
66 struct compat_xfrm_user_polexpire {
67 	struct compat_xfrm_userpolicy_info pol;
68 	/* 8 bytes additional padding on 64bit */
69 	u8 hard;
70 };
71 
72 #define XMSGSIZE(type) sizeof(struct type)
73 
74 static const int compat_msg_min[XFRM_NR_MSGTYPES] = {
75 	[XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_usersa_info),
76 	[XFRM_MSG_DELSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
77 	[XFRM_MSG_GETSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
78 	[XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_userpolicy_info),
79 	[XFRM_MSG_DELPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
80 	[XFRM_MSG_GETPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
81 	[XFRM_MSG_ALLOCSPI    - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_userspi_info),
82 	[XFRM_MSG_ACQUIRE     - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_user_acquire),
83 	[XFRM_MSG_EXPIRE      - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_user_expire),
84 	[XFRM_MSG_UPDPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_userpolicy_info),
85 	[XFRM_MSG_UPDSA       - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_usersa_info),
86 	[XFRM_MSG_POLEXPIRE   - XFRM_MSG_BASE] = XMSGSIZE(compat_xfrm_user_polexpire),
87 	[XFRM_MSG_FLUSHSA     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush),
88 	[XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0,
89 	[XFRM_MSG_NEWAE       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
90 	[XFRM_MSG_GETAE       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_aevent_id),
91 	[XFRM_MSG_REPORT      - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_report),
92 	[XFRM_MSG_MIGRATE     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
93 	[XFRM_MSG_NEWSADINFO  - XFRM_MSG_BASE] = sizeof(u32),
94 	[XFRM_MSG_GETSADINFO  - XFRM_MSG_BASE] = sizeof(u32),
95 	[XFRM_MSG_NEWSPDINFO  - XFRM_MSG_BASE] = sizeof(u32),
96 	[XFRM_MSG_GETSPDINFO  - XFRM_MSG_BASE] = sizeof(u32),
97 	[XFRM_MSG_MAPPING     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_mapping)
98 };
99 
100 static const struct nla_policy compat_policy[XFRMA_MAX+1] = {
101 	[XFRMA_SA]		= { .len = XMSGSIZE(compat_xfrm_usersa_info)},
102 	[XFRMA_POLICY]		= { .len = XMSGSIZE(compat_xfrm_userpolicy_info)},
103 	[XFRMA_LASTUSED]	= { .type = NLA_U64},
104 	[XFRMA_ALG_AUTH_TRUNC]	= { .len = sizeof(struct xfrm_algo_auth)},
105 	[XFRMA_ALG_AEAD]	= { .len = sizeof(struct xfrm_algo_aead) },
106 	[XFRMA_ALG_AUTH]	= { .len = sizeof(struct xfrm_algo) },
107 	[XFRMA_ALG_CRYPT]	= { .len = sizeof(struct xfrm_algo) },
108 	[XFRMA_ALG_COMP]	= { .len = sizeof(struct xfrm_algo) },
109 	[XFRMA_ENCAP]		= { .len = sizeof(struct xfrm_encap_tmpl) },
110 	[XFRMA_TMPL]		= { .len = sizeof(struct xfrm_user_tmpl) },
111 	[XFRMA_SEC_CTX]		= { .len = sizeof(struct xfrm_user_sec_ctx) },
112 	[XFRMA_LTIME_VAL]	= { .len = sizeof(struct xfrm_lifetime_cur) },
113 	[XFRMA_REPLAY_VAL]	= { .len = sizeof(struct xfrm_replay_state) },
114 	[XFRMA_REPLAY_THRESH]	= { .type = NLA_U32 },
115 	[XFRMA_ETIMER_THRESH]	= { .type = NLA_U32 },
116 	[XFRMA_SRCADDR]		= { .len = sizeof(xfrm_address_t) },
117 	[XFRMA_COADDR]		= { .len = sizeof(xfrm_address_t) },
118 	[XFRMA_POLICY_TYPE]	= { .len = sizeof(struct xfrm_userpolicy_type)},
119 	[XFRMA_MIGRATE]		= { .len = sizeof(struct xfrm_user_migrate) },
120 	[XFRMA_KMADDRESS]	= { .len = sizeof(struct xfrm_user_kmaddress) },
121 	[XFRMA_MARK]		= { .len = sizeof(struct xfrm_mark) },
122 	[XFRMA_TFCPAD]		= { .type = NLA_U32 },
123 	[XFRMA_REPLAY_ESN_VAL]	= { .len = sizeof(struct xfrm_replay_state_esn) },
124 	[XFRMA_SA_EXTRA_FLAGS]	= { .type = NLA_U32 },
125 	[XFRMA_PROTO]		= { .type = NLA_U8 },
126 	[XFRMA_ADDRESS_FILTER]	= { .len = sizeof(struct xfrm_address_filter) },
127 	[XFRMA_OFFLOAD_DEV]	= { .len = sizeof(struct xfrm_user_offload) },
128 	[XFRMA_SET_MARK]	= { .type = NLA_U32 },
129 	[XFRMA_SET_MARK_MASK]	= { .type = NLA_U32 },
130 	[XFRMA_IF_ID]		= { .type = NLA_U32 },
131 	[XFRMA_MTIMER_THRESH]	= { .type = NLA_U32 },
132 };
133 
xfrm_nlmsg_put_compat(struct sk_buff * skb,const struct nlmsghdr * nlh_src,u16 type)134 static struct nlmsghdr *xfrm_nlmsg_put_compat(struct sk_buff *skb,
135 			const struct nlmsghdr *nlh_src, u16 type)
136 {
137 	int payload = compat_msg_min[type];
138 	int src_len = xfrm_msg_min[type];
139 	struct nlmsghdr *nlh_dst;
140 
141 	/* Compat messages are shorter or equal to native (+padding) */
142 	if (WARN_ON_ONCE(src_len < payload))
143 		return ERR_PTR(-EMSGSIZE);
144 
145 	nlh_dst = nlmsg_put(skb, nlh_src->nlmsg_pid, nlh_src->nlmsg_seq,
146 			    nlh_src->nlmsg_type, payload, nlh_src->nlmsg_flags);
147 	if (!nlh_dst)
148 		return ERR_PTR(-EMSGSIZE);
149 
150 	memset(nlmsg_data(nlh_dst), 0, payload);
151 
152 	switch (nlh_src->nlmsg_type) {
153 	/* Compat message has the same layout as native */
154 	case XFRM_MSG_DELSA:
155 	case XFRM_MSG_DELPOLICY:
156 	case XFRM_MSG_FLUSHSA:
157 	case XFRM_MSG_FLUSHPOLICY:
158 	case XFRM_MSG_NEWAE:
159 	case XFRM_MSG_REPORT:
160 	case XFRM_MSG_MIGRATE:
161 	case XFRM_MSG_NEWSADINFO:
162 	case XFRM_MSG_NEWSPDINFO:
163 	case XFRM_MSG_MAPPING:
164 		WARN_ON_ONCE(src_len != payload);
165 		memcpy(nlmsg_data(nlh_dst), nlmsg_data(nlh_src), src_len);
166 		break;
167 	/* 4 byte alignment for trailing u64 on native, but not on compat */
168 	case XFRM_MSG_NEWSA:
169 	case XFRM_MSG_NEWPOLICY:
170 	case XFRM_MSG_UPDSA:
171 	case XFRM_MSG_UPDPOLICY:
172 		WARN_ON_ONCE(src_len != payload + 4);
173 		memcpy(nlmsg_data(nlh_dst), nlmsg_data(nlh_src), payload);
174 		break;
175 	case XFRM_MSG_EXPIRE: {
176 		const struct xfrm_user_expire *src_ue  = nlmsg_data(nlh_src);
177 		struct compat_xfrm_user_expire *dst_ue = nlmsg_data(nlh_dst);
178 
179 		/* compat_xfrm_user_expire has 4-byte smaller state */
180 		memcpy(dst_ue, src_ue, sizeof(dst_ue->state));
181 		dst_ue->hard = src_ue->hard;
182 		break;
183 	}
184 	case XFRM_MSG_ACQUIRE: {
185 		const struct xfrm_user_acquire *src_ua  = nlmsg_data(nlh_src);
186 		struct compat_xfrm_user_acquire *dst_ua = nlmsg_data(nlh_dst);
187 
188 		memcpy(dst_ua, src_ua, offsetof(struct compat_xfrm_user_acquire, aalgos));
189 		dst_ua->aalgos = src_ua->aalgos;
190 		dst_ua->ealgos = src_ua->ealgos;
191 		dst_ua->calgos = src_ua->calgos;
192 		dst_ua->seq    = src_ua->seq;
193 		break;
194 	}
195 	case XFRM_MSG_POLEXPIRE: {
196 		const struct xfrm_user_polexpire *src_upe  = nlmsg_data(nlh_src);
197 		struct compat_xfrm_user_polexpire *dst_upe = nlmsg_data(nlh_dst);
198 
199 		/* compat_xfrm_user_polexpire has 4-byte smaller state */
200 		memcpy(dst_upe, src_upe, sizeof(dst_upe->pol));
201 		dst_upe->hard = src_upe->hard;
202 		break;
203 	}
204 	case XFRM_MSG_ALLOCSPI: {
205 		const struct xfrm_userspi_info *src_usi = nlmsg_data(nlh_src);
206 		struct compat_xfrm_userspi_info *dst_usi = nlmsg_data(nlh_dst);
207 
208 		/* compat_xfrm_user_polexpire has 4-byte smaller state */
209 		memcpy(dst_usi, src_usi, sizeof(src_usi->info));
210 		dst_usi->min = src_usi->min;
211 		dst_usi->max = src_usi->max;
212 		break;
213 	}
214 	/* Not being sent by kernel */
215 	case XFRM_MSG_GETSA:
216 	case XFRM_MSG_GETPOLICY:
217 	case XFRM_MSG_GETAE:
218 	case XFRM_MSG_GETSADINFO:
219 	case XFRM_MSG_GETSPDINFO:
220 	default:
221 		pr_warn_once("unsupported nlmsg_type %d\n", nlh_src->nlmsg_type);
222 		return ERR_PTR(-EOPNOTSUPP);
223 	}
224 
225 	return nlh_dst;
226 }
227 
xfrm_nla_cpy(struct sk_buff * dst,const struct nlattr * src,int len)228 static int xfrm_nla_cpy(struct sk_buff *dst, const struct nlattr *src, int len)
229 {
230 	return nla_put(dst, src->nla_type, len, nla_data(src));
231 }
232 
xfrm_xlate64_attr(struct sk_buff * dst,const struct nlattr * src)233 static int xfrm_xlate64_attr(struct sk_buff *dst, const struct nlattr *src)
234 {
235 	switch (src->nla_type) {
236 	case XFRMA_PAD:
237 		/* Ignore */
238 		return 0;
239 	case XFRMA_UNSPEC:
240 	case XFRMA_ALG_AUTH:
241 	case XFRMA_ALG_CRYPT:
242 	case XFRMA_ALG_COMP:
243 	case XFRMA_ENCAP:
244 	case XFRMA_TMPL:
245 		return xfrm_nla_cpy(dst, src, nla_len(src));
246 	case XFRMA_SA:
247 		return xfrm_nla_cpy(dst, src, XMSGSIZE(compat_xfrm_usersa_info));
248 	case XFRMA_POLICY:
249 		return xfrm_nla_cpy(dst, src, XMSGSIZE(compat_xfrm_userpolicy_info));
250 	case XFRMA_SEC_CTX:
251 		return xfrm_nla_cpy(dst, src, nla_len(src));
252 	case XFRMA_LTIME_VAL:
253 		return nla_put_64bit(dst, src->nla_type, nla_len(src),
254 			nla_data(src), XFRMA_PAD);
255 	case XFRMA_REPLAY_VAL:
256 	case XFRMA_REPLAY_THRESH:
257 	case XFRMA_ETIMER_THRESH:
258 	case XFRMA_SRCADDR:
259 	case XFRMA_COADDR:
260 		return xfrm_nla_cpy(dst, src, nla_len(src));
261 	case XFRMA_LASTUSED:
262 		return nla_put_64bit(dst, src->nla_type, nla_len(src),
263 			nla_data(src), XFRMA_PAD);
264 	case XFRMA_POLICY_TYPE:
265 	case XFRMA_MIGRATE:
266 	case XFRMA_ALG_AEAD:
267 	case XFRMA_KMADDRESS:
268 	case XFRMA_ALG_AUTH_TRUNC:
269 	case XFRMA_MARK:
270 	case XFRMA_TFCPAD:
271 	case XFRMA_REPLAY_ESN_VAL:
272 	case XFRMA_SA_EXTRA_FLAGS:
273 	case XFRMA_PROTO:
274 	case XFRMA_ADDRESS_FILTER:
275 	case XFRMA_OFFLOAD_DEV:
276 	case XFRMA_SET_MARK:
277 	case XFRMA_SET_MARK_MASK:
278 	case XFRMA_IF_ID:
279 	case XFRMA_MTIMER_THRESH:
280 		return xfrm_nla_cpy(dst, src, nla_len(src));
281 	default:
282 		BUILD_BUG_ON(XFRMA_MAX != XFRMA_MTIMER_THRESH);
283 		pr_warn_once("unsupported nla_type %d\n", src->nla_type);
284 		return -EOPNOTSUPP;
285 	}
286 }
287 
288 /* Take kernel-built (64bit layout) and create 32bit layout for userspace */
xfrm_xlate64(struct sk_buff * dst,const struct nlmsghdr * nlh_src)289 static int xfrm_xlate64(struct sk_buff *dst, const struct nlmsghdr *nlh_src)
290 {
291 	u16 type = nlh_src->nlmsg_type - XFRM_MSG_BASE;
292 	const struct nlattr *nla, *attrs;
293 	struct nlmsghdr *nlh_dst;
294 	int len, remaining;
295 
296 	nlh_dst = xfrm_nlmsg_put_compat(dst, nlh_src, type);
297 	if (IS_ERR(nlh_dst))
298 		return PTR_ERR(nlh_dst);
299 
300 	attrs = nlmsg_attrdata(nlh_src, xfrm_msg_min[type]);
301 	len = nlmsg_attrlen(nlh_src, xfrm_msg_min[type]);
302 
303 	nla_for_each_attr(nla, attrs, len, remaining) {
304 		int err;
305 
306 		switch (nlh_src->nlmsg_type) {
307 		case XFRM_MSG_NEWSPDINFO:
308 			err = xfrm_nla_cpy(dst, nla, nla_len(nla));
309 			break;
310 		default:
311 			err = xfrm_xlate64_attr(dst, nla);
312 			break;
313 		}
314 		if (err)
315 			return err;
316 	}
317 
318 	nlmsg_end(dst, nlh_dst);
319 
320 	return 0;
321 }
322 
xfrm_alloc_compat(struct sk_buff * skb,const struct nlmsghdr * nlh_src)323 static int xfrm_alloc_compat(struct sk_buff *skb, const struct nlmsghdr *nlh_src)
324 {
325 	u16 type = nlh_src->nlmsg_type - XFRM_MSG_BASE;
326 	struct sk_buff *new = NULL;
327 	int err;
328 
329 	if (type >= ARRAY_SIZE(xfrm_msg_min)) {
330 		pr_warn_once("unsupported nlmsg_type %d\n", nlh_src->nlmsg_type);
331 		return -EOPNOTSUPP;
332 	}
333 
334 	if (skb_shinfo(skb)->frag_list == NULL) {
335 		new = alloc_skb(skb->len + skb_tailroom(skb), GFP_ATOMIC);
336 		if (!new)
337 			return -ENOMEM;
338 		skb_shinfo(skb)->frag_list = new;
339 	}
340 
341 	err = xfrm_xlate64(skb_shinfo(skb)->frag_list, nlh_src);
342 	if (err) {
343 		if (new) {
344 			kfree_skb(new);
345 			skb_shinfo(skb)->frag_list = NULL;
346 		}
347 		return err;
348 	}
349 
350 	return 0;
351 }
352 
353 /* Calculates len of translated 64-bit message. */
xfrm_user_rcv_calculate_len64(const struct nlmsghdr * src,struct nlattr * attrs[XFRMA_MAX+1],int maxtype)354 static size_t xfrm_user_rcv_calculate_len64(const struct nlmsghdr *src,
355 					    struct nlattr *attrs[XFRMA_MAX + 1],
356 					    int maxtype)
357 {
358 	size_t len = nlmsg_len(src);
359 
360 	switch (src->nlmsg_type) {
361 	case XFRM_MSG_NEWSA:
362 	case XFRM_MSG_NEWPOLICY:
363 	case XFRM_MSG_ALLOCSPI:
364 	case XFRM_MSG_ACQUIRE:
365 	case XFRM_MSG_UPDPOLICY:
366 	case XFRM_MSG_UPDSA:
367 		len += 4;
368 		break;
369 	case XFRM_MSG_EXPIRE:
370 	case XFRM_MSG_POLEXPIRE:
371 		len += 8;
372 		break;
373 	case XFRM_MSG_NEWSPDINFO:
374 		/* attirbutes are xfrm_spdattr_type_t, not xfrm_attr_type_t */
375 		return len;
376 	default:
377 		break;
378 	}
379 
380 	/* Unexpected for anything, but XFRM_MSG_NEWSPDINFO, please
381 	 * correct both 64=>32-bit and 32=>64-bit translators to copy
382 	 * new attributes.
383 	 */
384 	if (WARN_ON_ONCE(maxtype))
385 		return len;
386 
387 	if (attrs[XFRMA_SA])
388 		len += 4;
389 	if (attrs[XFRMA_POLICY])
390 		len += 4;
391 
392 	/* XXX: some attrs may need to be realigned
393 	 * if !CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
394 	 */
395 
396 	return len;
397 }
398 
xfrm_attr_cpy32(void * dst,size_t * pos,const struct nlattr * src,size_t size,int copy_len,int payload)399 static int xfrm_attr_cpy32(void *dst, size_t *pos, const struct nlattr *src,
400 			   size_t size, int copy_len, int payload)
401 {
402 	struct nlmsghdr *nlmsg = dst;
403 	struct nlattr *nla;
404 
405 	/* xfrm_user_rcv_msg_compat() relies on fact that 32-bit messages
406 	 * have the same len or shorted than 64-bit ones.
407 	 * 32-bit translation that is bigger than 64-bit original is unexpected.
408 	 */
409 	if (WARN_ON_ONCE(copy_len > payload))
410 		copy_len = payload;
411 
412 	if (size - *pos < nla_attr_size(payload))
413 		return -ENOBUFS;
414 
415 	nla = dst + *pos;
416 
417 	memcpy(nla, src, nla_attr_size(copy_len));
418 	nla->nla_len = nla_attr_size(payload);
419 	*pos += nla_attr_size(copy_len);
420 	nlmsg->nlmsg_len += nla->nla_len;
421 
422 	memset(dst + *pos, 0, payload - copy_len);
423 	*pos += payload - copy_len;
424 
425 	return 0;
426 }
427 
xfrm_xlate32_attr(void * dst,const struct nlattr * nla,size_t * pos,size_t size,struct netlink_ext_ack * extack)428 static int xfrm_xlate32_attr(void *dst, const struct nlattr *nla,
429 			     size_t *pos, size_t size,
430 			     struct netlink_ext_ack *extack)
431 {
432 	int type = nla_type(nla);
433 	u16 pol_len32, pol_len64;
434 	int err;
435 
436 	if (type > XFRMA_MAX) {
437 		BUILD_BUG_ON(XFRMA_MAX != XFRMA_MTIMER_THRESH);
438 		NL_SET_ERR_MSG(extack, "Bad attribute");
439 		return -EOPNOTSUPP;
440 	}
441 	type = array_index_nospec(type, XFRMA_MAX + 1);
442 	if (nla_len(nla) < compat_policy[type].len) {
443 		NL_SET_ERR_MSG(extack, "Attribute bad length");
444 		return -EOPNOTSUPP;
445 	}
446 
447 	pol_len32 = compat_policy[type].len;
448 	pol_len64 = xfrma_policy[type].len;
449 
450 	/* XFRMA_SA and XFRMA_POLICY - need to know how-to translate */
451 	if (pol_len32 != pol_len64) {
452 		if (nla_len(nla) != compat_policy[type].len) {
453 			NL_SET_ERR_MSG(extack, "Attribute bad length");
454 			return -EOPNOTSUPP;
455 		}
456 		err = xfrm_attr_cpy32(dst, pos, nla, size, pol_len32, pol_len64);
457 		if (err)
458 			return err;
459 	}
460 
461 	return xfrm_attr_cpy32(dst, pos, nla, size, nla_len(nla), nla_len(nla));
462 }
463 
xfrm_xlate32(struct nlmsghdr * dst,const struct nlmsghdr * src,struct nlattr * attrs[XFRMA_MAX+1],size_t size,u8 type,int maxtype,struct netlink_ext_ack * extack)464 static int xfrm_xlate32(struct nlmsghdr *dst, const struct nlmsghdr *src,
465 			struct nlattr *attrs[XFRMA_MAX+1],
466 			size_t size, u8 type, int maxtype,
467 			struct netlink_ext_ack *extack)
468 {
469 	size_t pos;
470 	int i;
471 
472 	memcpy(dst, src, NLMSG_HDRLEN);
473 	dst->nlmsg_len = NLMSG_HDRLEN + xfrm_msg_min[type];
474 	memset(nlmsg_data(dst), 0, xfrm_msg_min[type]);
475 
476 	switch (src->nlmsg_type) {
477 	/* Compat message has the same layout as native */
478 	case XFRM_MSG_DELSA:
479 	case XFRM_MSG_GETSA:
480 	case XFRM_MSG_DELPOLICY:
481 	case XFRM_MSG_GETPOLICY:
482 	case XFRM_MSG_FLUSHSA:
483 	case XFRM_MSG_FLUSHPOLICY:
484 	case XFRM_MSG_NEWAE:
485 	case XFRM_MSG_GETAE:
486 	case XFRM_MSG_REPORT:
487 	case XFRM_MSG_MIGRATE:
488 	case XFRM_MSG_NEWSADINFO:
489 	case XFRM_MSG_GETSADINFO:
490 	case XFRM_MSG_NEWSPDINFO:
491 	case XFRM_MSG_GETSPDINFO:
492 	case XFRM_MSG_MAPPING:
493 		memcpy(nlmsg_data(dst), nlmsg_data(src), compat_msg_min[type]);
494 		break;
495 	/* 4 byte alignment for trailing u64 on native, but not on compat */
496 	case XFRM_MSG_NEWSA:
497 	case XFRM_MSG_NEWPOLICY:
498 	case XFRM_MSG_UPDSA:
499 	case XFRM_MSG_UPDPOLICY:
500 		memcpy(nlmsg_data(dst), nlmsg_data(src), compat_msg_min[type]);
501 		break;
502 	case XFRM_MSG_EXPIRE: {
503 		const struct compat_xfrm_user_expire *src_ue = nlmsg_data(src);
504 		struct xfrm_user_expire *dst_ue = nlmsg_data(dst);
505 
506 		/* compat_xfrm_user_expire has 4-byte smaller state */
507 		memcpy(dst_ue, src_ue, sizeof(src_ue->state));
508 		dst_ue->hard = src_ue->hard;
509 		break;
510 	}
511 	case XFRM_MSG_ACQUIRE: {
512 		const struct compat_xfrm_user_acquire *src_ua = nlmsg_data(src);
513 		struct xfrm_user_acquire *dst_ua = nlmsg_data(dst);
514 
515 		memcpy(dst_ua, src_ua, offsetof(struct compat_xfrm_user_acquire, aalgos));
516 		dst_ua->aalgos = src_ua->aalgos;
517 		dst_ua->ealgos = src_ua->ealgos;
518 		dst_ua->calgos = src_ua->calgos;
519 		dst_ua->seq    = src_ua->seq;
520 		break;
521 	}
522 	case XFRM_MSG_POLEXPIRE: {
523 		const struct compat_xfrm_user_polexpire *src_upe = nlmsg_data(src);
524 		struct xfrm_user_polexpire *dst_upe = nlmsg_data(dst);
525 
526 		/* compat_xfrm_user_polexpire has 4-byte smaller state */
527 		memcpy(dst_upe, src_upe, sizeof(src_upe->pol));
528 		dst_upe->hard = src_upe->hard;
529 		break;
530 	}
531 	case XFRM_MSG_ALLOCSPI: {
532 		const struct compat_xfrm_userspi_info *src_usi = nlmsg_data(src);
533 		struct xfrm_userspi_info *dst_usi = nlmsg_data(dst);
534 
535 		/* compat_xfrm_user_polexpire has 4-byte smaller state */
536 		memcpy(dst_usi, src_usi, sizeof(src_usi->info));
537 		dst_usi->min = src_usi->min;
538 		dst_usi->max = src_usi->max;
539 		break;
540 	}
541 	default:
542 		NL_SET_ERR_MSG(extack, "Unsupported message type");
543 		return -EOPNOTSUPP;
544 	}
545 	pos = dst->nlmsg_len;
546 
547 	if (maxtype) {
548 		/* attirbutes are xfrm_spdattr_type_t, not xfrm_attr_type_t */
549 		WARN_ON_ONCE(src->nlmsg_type != XFRM_MSG_NEWSPDINFO);
550 
551 		for (i = 1; i <= maxtype; i++) {
552 			int err;
553 
554 			if (!attrs[i])
555 				continue;
556 
557 			/* just copy - no need for translation */
558 			err = xfrm_attr_cpy32(dst, &pos, attrs[i], size,
559 					nla_len(attrs[i]), nla_len(attrs[i]));
560 			if (err)
561 				return err;
562 		}
563 		return 0;
564 	}
565 
566 	for (i = 1; i < XFRMA_MAX + 1; i++) {
567 		int err;
568 
569 		if (i == XFRMA_PAD)
570 			continue;
571 
572 		if (!attrs[i])
573 			continue;
574 
575 		err = xfrm_xlate32_attr(dst, attrs[i], &pos, size, extack);
576 		if (err)
577 			return err;
578 	}
579 
580 	return 0;
581 }
582 
xfrm_user_rcv_msg_compat(const struct nlmsghdr * h32,int maxtype,const struct nla_policy * policy,struct netlink_ext_ack * extack)583 static struct nlmsghdr *xfrm_user_rcv_msg_compat(const struct nlmsghdr *h32,
584 			int maxtype, const struct nla_policy *policy,
585 			struct netlink_ext_ack *extack)
586 {
587 	/* netlink_rcv_skb() checks if a message has full (struct nlmsghdr) */
588 	u16 type = h32->nlmsg_type - XFRM_MSG_BASE;
589 	struct nlattr *attrs[XFRMA_MAX+1];
590 	struct nlmsghdr *h64;
591 	size_t len;
592 	int err;
593 
594 	BUILD_BUG_ON(ARRAY_SIZE(xfrm_msg_min) != ARRAY_SIZE(compat_msg_min));
595 
596 	if (type >= ARRAY_SIZE(xfrm_msg_min))
597 		return ERR_PTR(-EINVAL);
598 
599 	/* Don't call parse: the message might have only nlmsg header */
600 	if ((h32->nlmsg_type == XFRM_MSG_GETSA ||
601 	     h32->nlmsg_type == XFRM_MSG_GETPOLICY) &&
602 	    (h32->nlmsg_flags & NLM_F_DUMP))
603 		return NULL;
604 
605 	err = nlmsg_parse_deprecated(h32, compat_msg_min[type], attrs,
606 			maxtype ? : XFRMA_MAX, policy ? : compat_policy, extack);
607 	if (err < 0)
608 		return ERR_PTR(err);
609 
610 	len = xfrm_user_rcv_calculate_len64(h32, attrs, maxtype);
611 	/* The message doesn't need translation */
612 	if (len == nlmsg_len(h32))
613 		return NULL;
614 
615 	len += NLMSG_HDRLEN;
616 	h64 = kvmalloc(len, GFP_KERNEL);
617 	if (!h64)
618 		return ERR_PTR(-ENOMEM);
619 
620 	err = xfrm_xlate32(h64, h32, attrs, len, type, maxtype, extack);
621 	if (err < 0) {
622 		kvfree(h64);
623 		return ERR_PTR(err);
624 	}
625 
626 	return h64;
627 }
628 
xfrm_user_policy_compat(u8 ** pdata32,int optlen)629 static int xfrm_user_policy_compat(u8 **pdata32, int optlen)
630 {
631 	struct compat_xfrm_userpolicy_info *p = (void *)*pdata32;
632 	u8 *src_templates, *dst_templates;
633 	u8 *data64;
634 
635 	if (optlen < sizeof(*p))
636 		return -EINVAL;
637 
638 	data64 = kmalloc_track_caller(optlen + 4, GFP_USER | __GFP_NOWARN);
639 	if (!data64)
640 		return -ENOMEM;
641 
642 	memcpy(data64, *pdata32, sizeof(*p));
643 	memset(data64 + sizeof(*p), 0, 4);
644 
645 	src_templates = *pdata32 + sizeof(*p);
646 	dst_templates = data64 + sizeof(*p) + 4;
647 	memcpy(dst_templates, src_templates, optlen - sizeof(*p));
648 
649 	kfree(*pdata32);
650 	*pdata32 = data64;
651 	return 0;
652 }
653 
654 static struct xfrm_translator xfrm_translator = {
655 	.owner				= THIS_MODULE,
656 	.alloc_compat			= xfrm_alloc_compat,
657 	.rcv_msg_compat			= xfrm_user_rcv_msg_compat,
658 	.xlate_user_policy_sockptr	= xfrm_user_policy_compat,
659 };
660 
xfrm_compat_init(void)661 static int __init xfrm_compat_init(void)
662 {
663 	return xfrm_register_translator(&xfrm_translator);
664 }
665 
xfrm_compat_exit(void)666 static void __exit xfrm_compat_exit(void)
667 {
668 	xfrm_unregister_translator(&xfrm_translator);
669 }
670 
671 module_init(xfrm_compat_init);
672 module_exit(xfrm_compat_exit);
673 MODULE_LICENSE("GPL");
674 MODULE_AUTHOR("Dmitry Safonov");
675 MODULE_DESCRIPTION("XFRM 32-bit compatibility layer");
676