Commit 1620c888 authored by Steffen Klassert's avatar Steffen Klassert
Browse files

xfrm: Fix the usage of skb->sk 



xfrm assumed to always have a full socket at skb->sk.
This is not always true, so fix it by converting to a
full socket before it is used.

Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
parent 600258d5

net/ipv4/esp4.c

+1 −1
Original line number Diff line number Diff line
@@ -279,7 +279,7 @@ static void esp_output_done(void *data, int err) 
		    x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)

			esp_output_tail_tcp(x, skb);

		else

			xfrm_output_resume(skb->sk, skb, err);

			xfrm_output_resume(skb_to_full_sk(skb), skb, err);

	}

}

net/ipv6/esp6.c

+1 −1
Original line number Diff line number Diff line
@@ -315,7 +315,7 @@ static void esp_output_done(void *data, int err) 
		    x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)

			esp_output_tail_tcp(x, skb);

		else

			xfrm_output_resume(skb->sk, skb, err);

			xfrm_output_resume(skb_to_full_sk(skb), skb, err);

	}

}

net/ipv6/xfrm6_output.c

+2 −2
Original line number Diff line number Diff line
@@ -82,14 +82,14 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb) 


	toobig = skb->len > mtu && !skb_is_gso(skb);



	if (toobig && xfrm6_local_dontfrag(skb->sk)) {

	if (toobig && xfrm6_local_dontfrag(sk)) {

		xfrm6_local_rxpmtu(skb, mtu);

		kfree_skb(skb);

		return -EMSGSIZE;

	} else if (toobig && xfrm6_noneed_fragment(skb)) {

		skb->ignore_df = 1;

		goto skip_frag;

	} else if (!skb->ignore_df && toobig && skb->sk) {

	} else if (!skb->ignore_df && toobig && sk) {

		xfrm_local_error(skb, mtu);

		kfree_skb(skb);

		return -EMSGSIZE;

net/xfrm/xfrm_interface_core.c

+1 −1
Original line number Diff line number Diff line
@@ -506,7 +506,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) 
	skb_dst_set(skb, dst);

	skb->dev = tdev;



	err = dst_output(xi->net, skb->sk, skb);

	err = dst_output(xi->net, skb_to_full_sk(skb), skb);

	if (net_xmit_eval(err) == 0) {

		dev_sw_netstats_tx_add(dev, 1, length);

	} else {

net/xfrm/xfrm_output.c

+4 −3
Original line number Diff line number Diff line
@@ -796,7 +796,7 @@ static int xfrm4_tunnel_check_size(struct sk_buff *skb) 
	     !skb_gso_validate_network_len(skb, ip_skb_dst_mtu(skb->sk, skb)))) {

		skb->protocol = htons(ETH_P_IP);



		if (skb->sk)

		if (skb->sk && sk_fullsock(skb->sk))

			xfrm_local_error(skb, mtu);

		else

			icmp_send(skb, ICMP_DEST_UNREACH,
@@ -832,6 +832,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb) 
{

	int mtu, ret = 0;

	struct dst_entry *dst = skb_dst(skb);

	struct sock *sk = skb_to_full_sk(skb);



	if (skb->ignore_df)

		goto out;
@@ -846,9 +847,9 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb) 
		skb->dev = dst->dev;

		skb->protocol = htons(ETH_P_IPV6);



		if (xfrm6_local_dontfrag(skb->sk))

		if (xfrm6_local_dontfrag(sk))

			ipv6_stub->xfrm6_local_rxpmtu(skb, mtu);

		else if (skb->sk)

		else if (sk)

			xfrm_local_error(skb, mtu);

		else

			icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);