From: David S. Miller <davem@davemloft.net>
Date: Tue, 2 Oct 2018 05:29:25 +0000 (-0700)
Subject: Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec
X-Git-Tag: v4.19-rc7~28^2~22
X-Git-Url: https://repo.jachan.dev/J-linux.git/commitdiff_plain/ee0b6f4834b59bb0002e2dc8f42a73a399a9246e?hp=-c

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec

Steffen Klassert says:

====================
pull request (net): ipsec 2018-10-01

1) Validate address prefix lengths in the xfrm selector,
   otherwise we may hit undefined behaviour in the
   address matching functions if the prefix is too
   big for the given address family.

2) Fix skb leak on local message size errors.
   From Thadeu Lima de Souza Cascardo.

3) We currently reset the transport header back to the network
   header after a transport mode transformation is applied. This
   leads to an incorrect transport header when multiple transport
   mode transformations are applied. Reset the transport header
   only after all transformations are already applied to fix this.
   From Sowmini Varadhan.

4) We only support one offloaded xfrm, so reset crypto_done after
   the first transformation in xfrm_input(). Otherwise we may call
   the wrong input method for subsequent transformations.
   From Sowmini Varadhan.

5) Fix NULL pointer dereference when skb_dst_force clears the dst_entry.
   skb_dst_force does not really force a dst refcount anymore, it might
   clear it instead. xfrm code did not expect this, add a check to not
   dereference skb_dst() if it was cleared by skb_dst_force.

6) Validate xfrm template mode, otherwise we can get a stack-out-of-bounds
   read in xfrm_state_find. From Sean Tranchetti.

Please pull or let me know if there are problems.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
---

ee0b6f4834b59bb0002e2dc8f42a73a399a9246e
diff --combined net/xfrm/xfrm_input.c
index b89c9c7f8c5c,86f5afbd0a0c..be3520e429c9
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@@ -320,7 -320,6 +320,7 @@@ int xfrm_input(struct sk_buff *skb, in
  
  	seq = 0;
  	if (!spi && (err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) != 0) {
 +		secpath_reset(skb);
  		XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR);
  		goto drop;
  	}
@@@ -329,21 -328,17 +329,21 @@@
  				   XFRM_SPI_SKB_CB(skb)->daddroff);
  	do {
  		if (skb->sp->len == XFRM_MAX_DEPTH) {
 +			secpath_reset(skb);
  			XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR);
  			goto drop;
  		}
  
  		x = xfrm_state_lookup(net, mark, daddr, spi, nexthdr, family);
  		if (x == NULL) {
 +			secpath_reset(skb);
  			XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES);
  			xfrm_audit_state_notfound(skb, family, spi, seq);
  			goto drop;
  		}
  
 +		skb->mark = xfrm_smark_get(skb->mark, x);
 +
  		skb->sp->xvec[skb->sp->len++] = x;
  
  lock:
@@@ -458,6 -453,7 +458,7 @@@ resume
  			XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR);
  			goto drop;
  		}
+ 		crypto_done = false;
  	} while (!err);
  
  	err = xfrm_rcv_cb(skb, family, x->type->proto, 0);
diff --combined net/xfrm/xfrm_output.c
index 45ba07ab3e4f,36d15a38ce5e..261995d37ced
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@@ -66,7 -66,8 +66,7 @@@ static int xfrm_output_one(struct sk_bu
  			goto error_nolock;
  		}
  
 -		if (x->props.output_mark)
 -			skb->mark = x->props.output_mark;
 +		skb->mark = xfrm_smark_get(skb->mark, x);
  
  		err = x->outer_mode->output(x, skb);
  		if (err) {
@@@ -100,6 -101,10 +100,10 @@@
  		spin_unlock_bh(&x->lock);
  
  		skb_dst_force(skb);
+ 		if (!skb_dst(skb)) {
+ 			XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
+ 			goto error_nolock;
+ 		}
  
  		if (xfrm_offload(skb)) {
  			x->type_offload->encap(x, skb);
diff --combined net/xfrm/xfrm_policy.c
index 3110c3fbee20,626e0f4d1749..f094d4b3520d
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@@ -45,9 -45,8 +45,9 @@@ struct xfrm_flo 
  	u8 flags;
  };
  
 -static DEFINE_PER_CPU(struct xfrm_dst *, xfrm_last_dst);
 -static struct work_struct *xfrm_pcpu_work __read_mostly;
 +static DEFINE_SPINLOCK(xfrm_if_cb_lock);
 +static struct xfrm_if_cb const __rcu *xfrm_if_cb __read_mostly;
 +
  static DEFINE_SPINLOCK(xfrm_policy_afinfo_lock);
  static struct xfrm_policy_afinfo const __rcu *xfrm_policy_afinfo[AF_INET6 + 1]
  						__read_mostly;
@@@ -120,12 -119,6 +120,12 @@@ static const struct xfrm_policy_afinfo 
  	return afinfo;
  }
  
 +/* Called with rcu_read_lock(). */
 +static const struct xfrm_if_cb *xfrm_if_get_cb(void)
 +{
 +	return rcu_dereference(xfrm_if_cb);
 +}
 +
  struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos, int oif,
  				    const xfrm_address_t *saddr,
  				    const xfrm_address_t *daddr,
@@@ -189,8 -182,8 +189,8 @@@ static inline unsigned long make_jiffie
  static void xfrm_policy_timer(struct timer_list *t)
  {
  	struct xfrm_policy *xp = from_timer(xp, t, timer);
 -	unsigned long now = get_seconds();
 -	long next = LONG_MAX;
 +	time64_t now = ktime_get_real_seconds();
 +	time64_t next = TIME64_MAX;
  	int warn = 0;
  	int dir;
  
@@@ -202,7 -195,7 +202,7 @@@
  	dir = xfrm_policy_id2dir(xp->index);
  
  	if (xp->lft.hard_add_expires_seconds) {
 -		long tmo = xp->lft.hard_add_expires_seconds +
 +		time64_t tmo = xp->lft.hard_add_expires_seconds +
  			xp->curlft.add_time - now;
  		if (tmo <= 0)
  			goto expired;
@@@ -210,7 -203,7 +210,7 @@@
  			next = tmo;
  	}
  	if (xp->lft.hard_use_expires_seconds) {
 -		long tmo = xp->lft.hard_use_expires_seconds +
 +		time64_t tmo = xp->lft.hard_use_expires_seconds +
  			(xp->curlft.use_time ? : xp->curlft.add_time) - now;
  		if (tmo <= 0)
  			goto expired;
@@@ -218,7 -211,7 +218,7 @@@
  			next = tmo;
  	}
  	if (xp->lft.soft_add_expires_seconds) {
 -		long tmo = xp->lft.soft_add_expires_seconds +
 +		time64_t tmo = xp->lft.soft_add_expires_seconds +
  			xp->curlft.add_time - now;
  		if (tmo <= 0) {
  			warn = 1;
@@@ -228,7 -221,7 +228,7 @@@
  			next = tmo;
  	}
  	if (xp->lft.soft_use_expires_seconds) {
 -		long tmo = xp->lft.soft_use_expires_seconds +
 +		time64_t tmo = xp->lft.soft_use_expires_seconds +
  			(xp->curlft.use_time ? : xp->curlft.add_time) - now;
  		if (tmo <= 0) {
  			warn = 1;
@@@ -240,7 -233,7 +240,7 @@@
  
  	if (warn)
  		km_policy_expired(xp, dir, 0, 0);
 -	if (next != LONG_MAX &&
 +	if (next != TIME64_MAX &&
  	    !mod_timer(&xp->timer, jiffies + make_jiffies(next)))
  		xfrm_pol_hold(xp);
  
@@@ -754,7 -747,6 +754,7 @@@ int xfrm_policy_insert(int dir, struct 
  	newpos = NULL;
  	hlist_for_each_entry(pol, chain, bydst) {
  		if (pol->type == policy->type &&
 +		    pol->if_id == policy->if_id &&
  		    !selector_cmp(&pol->selector, &policy->selector) &&
  		    xfrm_policy_mark_match(policy, pol) &&
  		    xfrm_sec_ctx_match(pol->security, policy->security) &&
@@@ -791,7 -783,7 +791,7 @@@
  	}
  	policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir, policy->index);
  	hlist_add_head(&policy->byidx, net->xfrm.policy_byidx+idx_hash(net, policy->index));
 -	policy->curlft.add_time = get_seconds();
 +	policy->curlft.add_time = ktime_get_real_seconds();
  	policy->curlft.use_time = 0;
  	if (!mod_timer(&policy->timer, jiffies + HZ))
  		xfrm_pol_hold(policy);
@@@ -806,9 -798,8 +806,9 @@@
  }
  EXPORT_SYMBOL(xfrm_policy_insert);
  
 -struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u8 type,
 -					  int dir, struct xfrm_selector *sel,
 +struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u32 if_id,
 +					  u8 type, int dir,
 +					  struct xfrm_selector *sel,
  					  struct xfrm_sec_ctx *ctx, int delete,
  					  int *err)
  {
@@@ -821,7 -812,6 +821,7 @@@
  	ret = NULL;
  	hlist_for_each_entry(pol, chain, bydst) {
  		if (pol->type == type &&
 +		    pol->if_id == if_id &&
  		    (mark & pol->mark.m) == pol->mark.v &&
  		    !selector_cmp(sel, &pol->selector) &&
  		    xfrm_sec_ctx_match(ctx, pol->security)) {
@@@ -847,9 -837,8 +847,9 @@@
  }
  EXPORT_SYMBOL(xfrm_policy_bysel_ctx);
  
 -struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8 type,
 -				     int dir, u32 id, int delete, int *err)
 +struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u32 if_id,
 +				     u8 type, int dir, u32 id, int delete,
 +				     int *err)
  {
  	struct xfrm_policy *pol, *ret;
  	struct hlist_head *chain;
@@@ -864,7 -853,6 +864,7 @@@
  	ret = NULL;
  	hlist_for_each_entry(pol, chain, byidx) {
  		if (pol->type == type && pol->index == id &&
 +		    pol->if_id == if_id &&
  		    (mark & pol->mark.m) == pol->mark.v) {
  			xfrm_pol_hold(pol);
  			if (delete) {
@@@ -1068,14 -1056,13 +1068,14 @@@ EXPORT_SYMBOL(xfrm_policy_walk_done)
   */
  static int xfrm_policy_match(const struct xfrm_policy *pol,
  			     const struct flowi *fl,
 -			     u8 type, u16 family, int dir)
 +			     u8 type, u16 family, int dir, u32 if_id)
  {
  	const struct xfrm_selector *sel = &pol->selector;
  	int ret = -ESRCH;
  	bool match;
  
  	if (pol->family != family ||
 +	    pol->if_id != if_id ||
  	    (fl->flowi_mark & pol->mark.m) != pol->mark.v ||
  	    pol->type != type)
  		return ret;
@@@ -1090,8 -1077,7 +1090,8 @@@
  
  static struct xfrm_policy *xfrm_policy_lookup_bytype(struct net *net, u8 type,
  						     const struct flowi *fl,
 -						     u16 family, u8 dir)
 +						     u16 family, u8 dir,
 +						     u32 if_id)
  {
  	int err;
  	struct xfrm_policy *pol, *ret;
@@@ -1115,7 -1101,7 +1115,7 @@@
  	priority = ~0U;
  	ret = NULL;
  	hlist_for_each_entry_rcu(pol, chain, bydst) {
 -		err = xfrm_policy_match(pol, fl, type, family, dir);
 +		err = xfrm_policy_match(pol, fl, type, family, dir, if_id);
  		if (err) {
  			if (err == -ESRCH)
  				continue;
@@@ -1134,7 -1120,7 +1134,7 @@@
  		if ((pol->priority >= priority) && ret)
  			break;
  
 -		err = xfrm_policy_match(pol, fl, type, family, dir);
 +		err = xfrm_policy_match(pol, fl, type, family, dir, if_id);
  		if (err) {
  			if (err == -ESRCH)
  				continue;
@@@ -1159,25 -1145,21 +1159,25 @@@ fail
  	return ret;
  }
  
 -static struct xfrm_policy *
 -xfrm_policy_lookup(struct net *net, const struct flowi *fl, u16 family, u8 dir)
 +static struct xfrm_policy *xfrm_policy_lookup(struct net *net,
 +					      const struct flowi *fl,
 +					      u16 family, u8 dir, u32 if_id)
  {
  #ifdef CONFIG_XFRM_SUB_POLICY
  	struct xfrm_policy *pol;
  
 -	pol = xfrm_policy_lookup_bytype(net, XFRM_POLICY_TYPE_SUB, fl, family, dir);
 +	pol = xfrm_policy_lookup_bytype(net, XFRM_POLICY_TYPE_SUB, fl, family,
 +					dir, if_id);
  	if (pol != NULL)
  		return pol;
  #endif
 -	return xfrm_policy_lookup_bytype(net, XFRM_POLICY_TYPE_MAIN, fl, family, dir);
 +	return xfrm_policy_lookup_bytype(net, XFRM_POLICY_TYPE_MAIN, fl, family,
 +					 dir, if_id);
  }
  
  static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
 -						 const struct flowi *fl, u16 family)
 +						 const struct flowi *fl,
 +						 u16 family, u32 if_id)
  {
  	struct xfrm_policy *pol;
  
@@@ -1195,8 -1177,7 +1195,8 @@@
  
  		match = xfrm_selector_match(&pol->selector, fl, family);
  		if (match) {
 -			if ((sk->sk_mark & pol->mark.m) != pol->mark.v) {
 +			if ((sk->sk_mark & pol->mark.m) != pol->mark.v ||
 +			    pol->if_id != if_id) {
  				pol = NULL;
  				goto out;
  			}
@@@ -1287,7 -1268,7 +1287,7 @@@ int xfrm_sk_policy_insert(struct sock *
  	old_pol = rcu_dereference_protected(sk->sk_policy[dir],
  				lockdep_is_held(&net->xfrm.xfrm_policy_lock));
  	if (pol) {
 -		pol->curlft.add_time = get_seconds();
 +		pol->curlft.add_time = ktime_get_real_seconds();
  		pol->index = xfrm_gen_index(net, XFRM_POLICY_MAX+dir, 0);
  		xfrm_sk_policy_link(pol, dir);
  	}
@@@ -1324,7 -1305,6 +1324,7 @@@ static struct xfrm_policy *clone_policy
  		newp->lft = old->lft;
  		newp->curlft = old->curlft;
  		newp->mark = old->mark;
 +		newp->if_id = old->if_id;
  		newp->action = old->action;
  		newp->flags = old->flags;
  		newp->xfrm_nr = old->xfrm_nr;
@@@ -1410,8 -1390,7 +1410,8 @@@ xfrm_tmpl_resolve_one(struct xfrm_polic
  			}
  		}
  
 -		x = xfrm_state_find(remote, local, fl, tmpl, policy, &error, family);
 +		x = xfrm_state_find(remote, local, fl, tmpl, policy, &error,
 +				    family, policy->if_id);
  
  		if (x && x->km.state == XFRM_STATE_VALID) {
  			xfrm[nx++] = x;
@@@ -1628,11 -1607,10 +1628,11 @@@ static struct dst_entry *xfrm_bundle_cr
  		dst_copy_metrics(dst1, dst);
  
  		if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
 +			__u32 mark = xfrm_smark_get(fl->flowi_mark, xfrm[i]);
 +
  			family = xfrm[i]->props.family;
  			dst = xfrm_dst_lookup(xfrm[i], tos, fl->flowi_oif,
 -					      &saddr, &daddr, family,
 -					      xfrm[i]->props.output_mark);
 +					      &saddr, &daddr, family, mark);
  			err = PTR_ERR(dst);
  			if (IS_ERR(dst))
  				goto put_states;
@@@ -1714,8 -1692,7 +1714,8 @@@ static int xfrm_expand_policies(const s
  		pols[1] = xfrm_policy_lookup_bytype(xp_net(pols[0]),
  						    XFRM_POLICY_TYPE_MAIN,
  						    fl, family,
 -						    XFRM_POLICY_OUT);
 +						    XFRM_POLICY_OUT,
 +						    pols[0]->if_id);
  		if (pols[1]) {
  			if (IS_ERR(pols[1])) {
  				xfrm_pols_put(pols, *num_pols);
@@@ -1737,6 -1714,108 +1737,6 @@@
  
  }
  
 -static void xfrm_last_dst_update(struct xfrm_dst *xdst, struct xfrm_dst *old)
 -{
 -	this_cpu_write(xfrm_last_dst, xdst);
 -	if (old)
 -		dst_release(&old->u.dst);
 -}
 -
 -static void __xfrm_pcpu_work_fn(void)
 -{
 -	struct xfrm_dst *old;
 -
 -	old = this_cpu_read(xfrm_last_dst);
 -	if (old && !xfrm_bundle_ok(old))
 -		xfrm_last_dst_update(NULL, old);
 -}
 -
 -static void xfrm_pcpu_work_fn(struct work_struct *work)
 -{
 -	local_bh_disable();
 -	rcu_read_lock();
 -	__xfrm_pcpu_work_fn();
 -	rcu_read_unlock();
 -	local_bh_enable();
 -}
 -
 -void xfrm_policy_cache_flush(void)
 -{
 -	struct xfrm_dst *old;
 -	bool found = false;
 -	int cpu;
 -
 -	might_sleep();
 -
 -	local_bh_disable();
 -	rcu_read_lock();
 -	for_each_possible_cpu(cpu) {
 -		old = per_cpu(xfrm_last_dst, cpu);
 -		if (old && !xfrm_bundle_ok(old)) {
 -			if (smp_processor_id() == cpu) {
 -				__xfrm_pcpu_work_fn();
 -				continue;
 -			}
 -			found = true;
 -			break;
 -		}
 -	}
 -
 -	rcu_read_unlock();
 -	local_bh_enable();
 -
 -	if (!found)
 -		return;
 -
 -	get_online_cpus();
 -
 -	for_each_possible_cpu(cpu) {
 -		bool bundle_release;
 -
 -		rcu_read_lock();
 -		old = per_cpu(xfrm_last_dst, cpu);
 -		bundle_release = old && !xfrm_bundle_ok(old);
 -		rcu_read_unlock();
 -
 -		if (!bundle_release)
 -			continue;
 -
 -		if (cpu_online(cpu)) {
 -			schedule_work_on(cpu, &xfrm_pcpu_work[cpu]);
 -			continue;
 -		}
 -
 -		rcu_read_lock();
 -		old = per_cpu(xfrm_last_dst, cpu);
 -		if (old && !xfrm_bundle_ok(old)) {
 -			per_cpu(xfrm_last_dst, cpu) = NULL;
 -			dst_release(&old->u.dst);
 -		}
 -		rcu_read_unlock();
 -	}
 -
 -	put_online_cpus();
 -}
 -
 -static bool xfrm_xdst_can_reuse(struct xfrm_dst *xdst,
 -				struct xfrm_state * const xfrm[],
 -				int num)
 -{
 -	const struct dst_entry *dst = &xdst->u.dst;
 -	int i;
 -
 -	if (xdst->num_xfrms != num)
 -		return false;
 -
 -	for (i = 0; i < num; i++) {
 -		if (!dst || dst->xfrm != xfrm[i])
 -			return false;
 -		dst = xfrm_dst_child(dst);
 -	}
 -
 -	return xfrm_bundle_ok(xdst);
 -}
 -
  static struct xfrm_dst *
  xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
  			       const struct flowi *fl, u16 family,
@@@ -1745,21 -1824,34 +1745,21 @@@
  	struct net *net = xp_net(pols[0]);
  	struct xfrm_state *xfrm[XFRM_MAX_DEPTH];
  	struct xfrm_dst *bundle[XFRM_MAX_DEPTH];
 -	struct xfrm_dst *xdst, *old;
 +	struct xfrm_dst *xdst;
  	struct dst_entry *dst;
  	int err;
  
  	/* Try to instantiate a bundle */
  	err = xfrm_tmpl_resolve(pols, num_pols, fl, xfrm, family);
  	if (err <= 0) {
 -		if (err != 0 && err != -EAGAIN)
 +		if (err == 0)
 +			return NULL;
 +
 +		if (err != -EAGAIN)
  			XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR);
  		return ERR_PTR(err);
  	}
  
 -	xdst = this_cpu_read(xfrm_last_dst);
 -	if (xdst &&
 -	    xdst->u.dst.dev == dst_orig->dev &&
 -	    xdst->num_pols == num_pols &&
 -	    memcmp(xdst->pols, pols,
 -		   sizeof(struct xfrm_policy *) * num_pols) == 0 &&
 -	    xfrm_xdst_can_reuse(xdst, xfrm, err)) {
 -		dst_hold(&xdst->u.dst);
 -		xfrm_pols_put(pols, num_pols);
 -		while (err > 0)
 -			xfrm_state_put(xfrm[--err]);
 -		return xdst;
 -	}
 -
 -	old = xdst;
 -
  	dst = xfrm_bundle_create(pols[0], xfrm, bundle, err, fl, dst_orig);
  	if (IS_ERR(dst)) {
  		XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLEGENERROR);
@@@ -1772,6 -1864,9 +1772,6 @@@
  	memcpy(xdst->pols, pols, sizeof(struct xfrm_policy *) * num_pols);
  	xdst->policy_genid = atomic_read(&pols[0]->genid);
  
 -	atomic_set(&xdst->u.dst.__refcnt, 2);
 -	xfrm_last_dst_update(xdst, old);
 -
  	return xdst;
  }
  
@@@ -1952,10 -2047,8 +1952,10 @@@ free_dst
  	goto out;
  }
  
 -static struct xfrm_dst *
 -xfrm_bundle_lookup(struct net *net, const struct flowi *fl, u16 family, u8 dir, struct xfrm_flo *xflo)
 +static struct xfrm_dst *xfrm_bundle_lookup(struct net *net,
 +					   const struct flowi *fl,
 +					   u16 family, u8 dir,
 +					   struct xfrm_flo *xflo, u32 if_id)
  {
  	struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
  	int num_pols = 0, num_xfrms = 0, err;
@@@ -1964,7 -2057,7 +1964,7 @@@
  	/* Resolve policies to use if we couldn't get them from
  	 * previous cache entry */
  	num_pols = 1;
 -	pols[0] = xfrm_policy_lookup(net, fl, family, dir);
 +	pols[0] = xfrm_policy_lookup(net, fl, family, dir, if_id);
  	err = xfrm_expand_policies(fl, family, pols,
  					   &num_pols, &num_xfrms);
  	if (err < 0)
@@@ -1974,15 -2067,13 +1974,15 @@@
  	if (num_xfrms <= 0)
  		goto make_dummy_bundle;
  
 -	local_bh_disable();
  	xdst = xfrm_resolve_and_create_bundle(pols, num_pols, fl, family,
  					      xflo->dst_orig);
 -	local_bh_enable();
 -
  	if (IS_ERR(xdst)) {
  		err = PTR_ERR(xdst);
 +		if (err == -EREMOTE) {
 +			xfrm_pols_put(pols, num_pols);
 +			return NULL;
 +		}
 +
  		if (err != -EAGAIN)
  			goto error;
  		goto make_dummy_bundle;
@@@ -2032,19 -2123,14 +2032,19 @@@ static struct dst_entry *make_blackhole
  	return ret;
  }
  
 -/* Main function: finds/creates a bundle for given flow.
 +/* Finds/creates a bundle for given flow and if_id
   *
   * At the moment we eat a raw IP route. Mostly to speed up lookups
   * on interfaces with disabled IPsec.
 + *
 + * xfrm_lookup uses an if_id of 0 by default, and is provided for
 + * compatibility
   */
 -struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
 -			      const struct flowi *fl,
 -			      const struct sock *sk, int flags)
 +struct dst_entry *xfrm_lookup_with_ifid(struct net *net,
 +					struct dst_entry *dst_orig,
 +					const struct flowi *fl,
 +					const struct sock *sk,
 +					int flags, u32 if_id)
  {
  	struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
  	struct xfrm_dst *xdst;
@@@ -2060,8 -2146,7 +2060,8 @@@
  	sk = sk_const_to_full_sk(sk);
  	if (sk && sk->sk_policy[XFRM_POLICY_OUT]) {
  		num_pols = 1;
 -		pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl, family);
 +		pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl, family,
 +						if_id);
  		err = xfrm_expand_policies(fl, family, pols,
  					   &num_pols, &num_xfrms);
  		if (err < 0)
@@@ -2073,16 -2158,15 +2073,16 @@@
  				goto no_transform;
  			}
  
 -			local_bh_disable();
  			xdst = xfrm_resolve_and_create_bundle(
  					pols, num_pols, fl,
  					family, dst_orig);
 -			local_bh_enable();
  
  			if (IS_ERR(xdst)) {
  				xfrm_pols_put(pols, num_pols);
  				err = PTR_ERR(xdst);
 +				if (err == -EREMOTE)
 +					goto nopol;
 +
  				goto dropdst;
  			} else if (xdst == NULL) {
  				num_xfrms = 0;
@@@ -2105,7 -2189,7 +2105,7 @@@
  		    !net->xfrm.policy_count[XFRM_POLICY_OUT])
  			goto nopol;
  
 -		xdst = xfrm_bundle_lookup(net, fl, family, dir, &xflo);
 +		xdst = xfrm_bundle_lookup(net, fl, family, dir, &xflo, if_id);
  		if (xdst == NULL)
  			goto nopol;
  		if (IS_ERR(xdst)) {
@@@ -2150,7 -2234,7 +2150,7 @@@ no_transform
  	}
  
  	for (i = 0; i < num_pols; i++)
 -		pols[i]->curlft.use_time = get_seconds();
 +		pols[i]->curlft.use_time = ktime_get_real_seconds();
  
  	if (num_xfrms < 0) {
  		/* Prohibit the flow */
@@@ -2186,19 -2270,6 +2186,19 @@@ dropdst
  	xfrm_pols_put(pols, drop_pols);
  	return ERR_PTR(err);
  }
 +EXPORT_SYMBOL(xfrm_lookup_with_ifid);
 +
 +/* Main function: finds/creates a bundle for given flow.
 + *
 + * At the moment we eat a raw IP route. Mostly to speed up lookups
 + * on interfaces with disabled IPsec.
 + */
 +struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
 +			      const struct flowi *fl, const struct sock *sk,
 +			      int flags)
 +{
 +	return xfrm_lookup_with_ifid(net, dst_orig, fl, sk, flags, 0);
 +}
  EXPORT_SYMBOL(xfrm_lookup);
  
  /* Callers of xfrm_lookup_route() must ensure a call to dst_output().
@@@ -2297,7 -2368,6 +2297,7 @@@ int __xfrm_decode_session(struct sk_buf
  		return -EAFNOSUPPORT;
  
  	afinfo->decode_session(skb, fl, reverse);
 +
  	err = security_xfrm_decode_session(skb, &fl->flowi_secid);
  	rcu_read_unlock();
  	return err;
@@@ -2328,19 -2398,6 +2328,19 @@@ int __xfrm_policy_check(struct sock *sk
  	int reverse;
  	struct flowi fl;
  	int xerr_idx = -1;
 +	const struct xfrm_if_cb *ifcb;
 +	struct xfrm_if *xi;
 +	u32 if_id = 0;
 +
 +	rcu_read_lock();
 +	ifcb = xfrm_if_get_cb();
 +
 +	if (ifcb) {
 +		xi = ifcb->decode_session(skb);
 +		if (xi)
 +			if_id = xi->p.if_id;
 +	}
 +	rcu_read_unlock();
  
  	reverse = dir & ~XFRM_POLICY_MASK;
  	dir &= XFRM_POLICY_MASK;
@@@ -2368,7 -2425,7 +2368,7 @@@
  	pol = NULL;
  	sk = sk_to_full_sk(sk);
  	if (sk && sk->sk_policy[dir]) {
 -		pol = xfrm_sk_policy_lookup(sk, dir, &fl, family);
 +		pol = xfrm_sk_policy_lookup(sk, dir, &fl, family, if_id);
  		if (IS_ERR(pol)) {
  			XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR);
  			return 0;
@@@ -2376,7 -2433,7 +2376,7 @@@
  	}
  
  	if (!pol)
 -		pol = xfrm_policy_lookup(net, &fl, family, dir);
 +		pol = xfrm_policy_lookup(net, &fl, family, dir, if_id);
  
  	if (IS_ERR(pol)) {
  		XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR);
@@@ -2392,7 -2449,7 +2392,7 @@@
  		return 1;
  	}
  
 -	pol->curlft.use_time = get_seconds();
 +	pol->curlft.use_time = ktime_get_real_seconds();
  
  	pols[0] = pol;
  	npols++;
@@@ -2400,13 -2457,13 +2400,13 @@@
  	if (pols[0]->type != XFRM_POLICY_TYPE_MAIN) {
  		pols[1] = xfrm_policy_lookup_bytype(net, XFRM_POLICY_TYPE_MAIN,
  						    &fl, family,
 -						    XFRM_POLICY_IN);
 +						    XFRM_POLICY_IN, if_id);
  		if (pols[1]) {
  			if (IS_ERR(pols[1])) {
  				XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR);
  				return 0;
  			}
 -			pols[1]->curlft.use_time = get_seconds();
 +			pols[1]->curlft.use_time = ktime_get_real_seconds();
  			npols++;
  		}
  	}
@@@ -2491,6 -2548,10 +2491,10 @@@ int __xfrm_route_forward(struct sk_buf
  	}
  
  	skb_dst_force(skb);
+ 	if (!skb_dst(skb)) {
+ 		XFRM_INC_STATS(net, LINUX_MIB_XFRMFWDHDRERROR);
+ 		return 0;
+ 	}
  
  	dst = xfrm_lookup(net, skb_dst(skb), &fl, NULL, XFRM_LOOKUP_QUEUE);
  	if (IS_ERR(dst)) {
@@@ -2765,21 -2826,6 +2769,21 @@@ void xfrm_policy_unregister_afinfo(cons
  }
  EXPORT_SYMBOL(xfrm_policy_unregister_afinfo);
  
 +void xfrm_if_register_cb(const struct xfrm_if_cb *ifcb)
 +{
 +	spin_lock(&xfrm_if_cb_lock);
 +	rcu_assign_pointer(xfrm_if_cb, ifcb);
 +	spin_unlock(&xfrm_if_cb_lock);
 +}
 +EXPORT_SYMBOL(xfrm_if_register_cb);
 +
 +void xfrm_if_unregister_cb(void)
 +{
 +	RCU_INIT_POINTER(xfrm_if_cb, NULL);
 +	synchronize_rcu();
 +}
 +EXPORT_SYMBOL(xfrm_if_unregister_cb);
 +
  #ifdef CONFIG_XFRM_STATISTICS
  static int __net_init xfrm_statistics_init(struct net *net)
  {
@@@ -2947,13 -2993,19 +2951,13 @@@ static struct pernet_operations __net_i
  
  void __init xfrm_init(void)
  {
 -	int i;
 -
 -	xfrm_pcpu_work = kmalloc_array(NR_CPUS, sizeof(*xfrm_pcpu_work),
 -				       GFP_KERNEL);
 -	BUG_ON(!xfrm_pcpu_work);
 -
 -	for (i = 0; i < NR_CPUS; i++)
 -		INIT_WORK(&xfrm_pcpu_work[i], xfrm_pcpu_work_fn);
 -
  	register_pernet_subsys(&xfrm_net_ops);
  	xfrm_dev_init();
  	seqcount_init(&xfrm_policy_hash_generation);
  	xfrm_input_init();
 +
 +	RCU_INIT_POINTER(xfrm_if_cb, NULL);
 +	synchronize_rcu();
  }
  
  #ifdef CONFIG_AUDITSYSCALL
diff --combined net/xfrm/xfrm_user.c
index 4791aa8b8185,d0672c400c2f..df7ca2dabc48
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@@ -151,10 -151,16 +151,16 @@@ static int verify_newsa_info(struct xfr
  	err = -EINVAL;
  	switch (p->family) {
  	case AF_INET:
+ 		if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
+ 			goto out;
+ 
  		break;
  
  	case AF_INET6:
  #if IS_ENABLED(CONFIG_IPV6)
+ 		if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128)
+ 			goto out;
+ 
  		break;
  #else
  		err = -EAFNOSUPPORT;
@@@ -527,19 -533,6 +533,19 @@@ static void xfrm_update_ae_params(struc
  		x->replay_maxdiff = nla_get_u32(rt);
  }
  
 +static void xfrm_smark_init(struct nlattr **attrs, struct xfrm_mark *m)
 +{
 +	if (attrs[XFRMA_SET_MARK]) {
 +		m->v = nla_get_u32(attrs[XFRMA_SET_MARK]);
 +		if (attrs[XFRMA_SET_MARK_MASK])
 +			m->m = nla_get_u32(attrs[XFRMA_SET_MARK_MASK]);
 +		else
 +			m->m = 0xffffffff;
 +	} else {
 +		m->v = m->m = 0;
 +	}
 +}
 +
  static struct xfrm_state *xfrm_state_construct(struct net *net,
  					       struct xfrm_usersa_info *p,
  					       struct nlattr **attrs,
@@@ -592,10 -585,8 +598,10 @@@
  
  	xfrm_mark_get(attrs, &x->mark);
  
 -	if (attrs[XFRMA_OUTPUT_MARK])
 -		x->props.output_mark = nla_get_u32(attrs[XFRMA_OUTPUT_MARK]);
 +	xfrm_smark_init(attrs, &x->props.smark);
 +
 +	if (attrs[XFRMA_IF_ID])
 +		x->if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
  
  	err = __xfrm_init_state(x, false, attrs[XFRMA_OFFLOAD_DEV]);
  	if (err)
@@@ -839,18 -830,6 +845,18 @@@ static int copy_to_user_auth(struct xfr
  	return 0;
  }
  
 +static int xfrm_smark_put(struct sk_buff *skb, struct xfrm_mark *m)
 +{
 +	int ret = 0;
 +
 +	if (m->v | m->m) {
 +		ret = nla_put_u32(skb, XFRMA_SET_MARK, m->v);
 +		if (!ret)
 +			ret = nla_put_u32(skb, XFRMA_SET_MARK_MASK, m->m);
 +	}
 +	return ret;
 +}
 +
  /* Don't change this without updating xfrm_sa_len! */
  static int copy_to_user_state_extra(struct xfrm_state *x,
  				    struct xfrm_usersa_info *p,
@@@ -914,11 -893,6 +920,11 @@@
  	ret = xfrm_mark_put(skb, &x->mark);
  	if (ret)
  		goto out;
 +
 +	ret = xfrm_smark_put(skb, &x->props.smark);
 +	if (ret)
 +		goto out;
 +
  	if (x->replay_esn)
  		ret = nla_put(skb, XFRMA_REPLAY_ESN_VAL,
  			      xfrm_replay_state_esn_len(x->replay_esn),
@@@ -932,8 -906,8 +938,8 @@@
  		ret = copy_user_offload(&x->xso, skb);
  	if (ret)
  		goto out;
 -	if (x->props.output_mark) {
 -		ret = nla_put_u32(skb, XFRMA_OUTPUT_MARK, x->props.output_mark);
 +	if (x->if_id) {
 +		ret = nla_put_u32(skb, XFRMA_IF_ID, x->if_id);
  		if (ret)
  			goto out;
  	}
@@@ -1287,7 -1261,6 +1293,7 @@@ static int xfrm_alloc_userspi(struct sk
  	int err;
  	u32 mark;
  	struct xfrm_mark m;
 +	u32 if_id = 0;
  
  	p = nlmsg_data(nlh);
  	err = verify_spi_info(p->info.id.proto, p->min, p->max);
@@@ -1300,10 -1273,6 +1306,10 @@@
  	x = NULL;
  
  	mark = xfrm_mark_get(attrs, &m);
 +
 +	if (attrs[XFRMA_IF_ID])
 +		if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
 +
  	if (p->info.seq) {
  		x = xfrm_find_acq_byseq(net, mark, p->info.seq);
  		if (x && !xfrm_addr_equal(&x->id.daddr, daddr, family)) {
@@@ -1314,7 -1283,7 +1320,7 @@@
  
  	if (!x)
  		x = xfrm_find_acq(net, &m, p->info.mode, p->info.reqid,
 -				  p->info.id.proto, daddr,
 +				  if_id, p->info.id.proto, daddr,
  				  &p->info.saddr, 1,
  				  family);
  	err = -ENOENT;
@@@ -1396,10 -1365,16 +1402,16 @@@ static int verify_newpolicy_info(struc
  
  	switch (p->sel.family) {
  	case AF_INET:
+ 		if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
+ 			return -EINVAL;
+ 
  		break;
  
  	case AF_INET6:
  #if IS_ENABLED(CONFIG_IPV6)
+ 		if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128)
+ 			return -EINVAL;
+ 
  		break;
  #else
  		return  -EAFNOSUPPORT;
@@@ -1480,6 -1455,9 +1492,9 @@@ static int validate_tmpl(int nr, struc
  		    (ut[i].family != prev_family))
  			return -EINVAL;
  
+ 		if (ut[i].mode >= XFRM_MODE_MAX)
+ 			return -EINVAL;
+ 
  		prev_family = ut[i].family;
  
  		switch (ut[i].family) {
@@@ -1602,9 -1580,6 +1617,9 @@@ static struct xfrm_policy *xfrm_policy_
  
  	xfrm_mark_get(attrs, &xp->mark);
  
 +	if (attrs[XFRMA_IF_ID])
 +		xp->if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
 +
  	return xp;
   error:
  	*errp = err;
@@@ -1752,8 -1727,6 +1767,8 @@@ static int dump_one_policy(struct xfrm_
  		err = copy_to_user_policy_type(xp->type, skb);
  	if (!err)
  		err = xfrm_mark_put(skb, &xp->mark);
 +	if (!err)
 +		err = xfrm_if_id_put(skb, xp->if_id);
  	if (err) {
  		nlmsg_cancel(skb, nlh);
  		return err;
@@@ -1835,7 -1808,6 +1850,7 @@@ static int xfrm_get_policy(struct sk_bu
  	int delete;
  	struct xfrm_mark m;
  	u32 mark = xfrm_mark_get(attrs, &m);
 +	u32 if_id = 0;
  
  	p = nlmsg_data(nlh);
  	delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY;
@@@ -1848,11 -1820,8 +1863,11 @@@
  	if (err)
  		return err;
  
 +	if (attrs[XFRMA_IF_ID])
 +		if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
 +
  	if (p->index)
 -		xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, delete, &err);
 +		xp = xfrm_policy_byid(net, mark, if_id, type, p->dir, p->index, delete, &err);
  	else {
  		struct nlattr *rt = attrs[XFRMA_SEC_CTX];
  		struct xfrm_sec_ctx *ctx;
@@@ -1869,7 -1838,7 +1884,7 @@@
  			if (err)
  				return err;
  		}
 -		xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir, &p->sel,
 +		xp = xfrm_policy_bysel_ctx(net, mark, if_id, type, p->dir, &p->sel,
  					   ctx, delete, &err);
  		security_xfrm_policy_free(ctx);
  	}
@@@ -1992,10 -1961,6 +2007,10 @@@ static int build_aevent(struct sk_buff 
  	if (err)
  		goto out_cancel;
  
 +	err = xfrm_if_id_put(skb, x->if_id);
 +	if (err)
 +		goto out_cancel;
 +
  	nlmsg_end(skb, nlh);
  	return 0;
  
@@@ -2138,7 -2103,6 +2153,7 @@@ static int xfrm_add_pol_expire(struct s
  	int err = -ENOENT;
  	struct xfrm_mark m;
  	u32 mark = xfrm_mark_get(attrs, &m);
 +	u32 if_id = 0;
  
  	err = copy_from_user_policy_type(&type, attrs);
  	if (err)
@@@ -2148,11 -2112,8 +2163,11 @@@
  	if (err)
  		return err;
  
 +	if (attrs[XFRMA_IF_ID])
 +		if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
 +
  	if (p->index)
 -		xp = xfrm_policy_byid(net, mark, type, p->dir, p->index, 0, &err);
 +		xp = xfrm_policy_byid(net, mark, if_id, type, p->dir, p->index, 0, &err);
  	else {
  		struct nlattr *rt = attrs[XFRMA_SEC_CTX];
  		struct xfrm_sec_ctx *ctx;
@@@ -2169,7 -2130,7 +2184,7 @@@
  			if (err)
  				return err;
  		}
 -		xp = xfrm_policy_bysel_ctx(net, mark, type, p->dir,
 +		xp = xfrm_policy_bysel_ctx(net, mark, if_id, type, p->dir,
  					   &p->sel, ctx, 0, &err);
  		security_xfrm_policy_free(ctx);
  	}
@@@ -2551,9 -2512,7 +2566,9 @@@ static const struct nla_policy xfrma_po
  	[XFRMA_PROTO]		= { .type = NLA_U8 },
  	[XFRMA_ADDRESS_FILTER]	= { .len = sizeof(struct xfrm_address_filter) },
  	[XFRMA_OFFLOAD_DEV]	= { .len = sizeof(struct xfrm_user_offload) },
 -	[XFRMA_OUTPUT_MARK]	= { .type = NLA_U32 },
 +	[XFRMA_SET_MARK]	= { .type = NLA_U32 },
 +	[XFRMA_SET_MARK_MASK]	= { .type = NLA_U32 },
 +	[XFRMA_IF_ID]		= { .type = NLA_U32 },
  };
  
  static const struct nla_policy xfrma_spd_policy[XFRMA_SPD_MAX+1] = {
@@@ -2685,10 -2644,6 +2700,10 @@@ static int build_expire(struct sk_buff 
  	if (err)
  		return err;
  
 +	err = xfrm_if_id_put(skb, x->if_id);
 +	if (err)
 +		return err;
 +
  	nlmsg_end(skb, nlh);
  	return 0;
  }
@@@ -2783,12 -2738,8 +2798,12 @@@ static inline unsigned int xfrm_sa_len(
  		l += nla_total_size(sizeof(x->props.extra_flags));
  	if (x->xso.dev)
  		 l += nla_total_size(sizeof(x->xso));
 -	if (x->props.output_mark)
 -		l += nla_total_size(sizeof(x->props.output_mark));
 +	if (x->props.smark.v | x->props.smark.m) {
 +		l += nla_total_size(sizeof(x->props.smark.v));
 +		l += nla_total_size(sizeof(x->props.smark.m));
 +	}
 +	if (x->if_id)
 +		l += nla_total_size(sizeof(x->if_id));
  
  	/* Must count x->lastused as it may become non-zero behind our back. */
  	l += nla_total_size_64bit(sizeof(u64));
@@@ -2918,8 -2869,6 +2933,8 @@@ static int build_acquire(struct sk_buf
  		err = copy_to_user_policy_type(xp->type, skb);
  	if (!err)
  		err = xfrm_mark_put(skb, &xp->mark);
 +	if (!err)
 +		err = xfrm_if_id_put(skb, xp->if_id);
  	if (err) {
  		nlmsg_cancel(skb, nlh);
  		return err;
@@@ -3036,8 -2985,6 +3051,8 @@@ static int build_polexpire(struct sk_bu
  		err = copy_to_user_policy_type(xp->type, skb);
  	if (!err)
  		err = xfrm_mark_put(skb, &xp->mark);
 +	if (!err)
 +		err = xfrm_if_id_put(skb, xp->if_id);
  	if (err) {
  		nlmsg_cancel(skb, nlh);
  		return err;
@@@ -3119,8 -3066,6 +3134,8 @@@ static int xfrm_notify_policy(struct xf
  		err = copy_to_user_policy_type(xp->type, skb);
  	if (!err)
  		err = xfrm_mark_put(skb, &xp->mark);
 +	if (!err)
 +		err = xfrm_if_id_put(skb, xp->if_id);
  	if (err)
  		goto out_free_skb;
  
@@@ -3354,3 -3299,4 +3369,3 @@@ module_init(xfrm_user_init)
  module_exit(xfrm_user_exit);
  MODULE_LICENSE("GPL");
  MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_XFRM);
 -